Skip to content
OpenAdvisories
Unscored Public exploit CVE-2015-7214 EUVD-2015-7146GHSA-p6rv-hx36-fjv2

Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-sou…

Published Dec 16, 2015 · Updated Aug 6, 2024 · Assigned by mozilla

Package: firefox Package: thunderbird Ecosystem: Ubuntu

Description

Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 8 icedove 38.5.0-1~deb8u1 DSA-3432-1
Debian 8 iceweasel 38.5.0esr-1~deb8u2 DSA-3422-1
Debian 7 icedove 38.5.0-1~deb7u1 DSA-3432-1
Debian 7 iceweasel 38.5.0esr-1~deb7u2 DSA-3422-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS firefox 43.0+build1-0ubuntu0.14.04.1 USN-2833-1
Ubuntu 14.04 LTS thunderbird 1:38.5.1+build2-0ubuntu0.14.04.1 USN-2859-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 firefox 38.5.0-3.el7_2 RHSA-2015:2657
RHEL 7 thunderbird 38.5.0-1.el7_2 RHSA-2016:0001
RHEL 6 firefox 38.5.0-2.el6_7 RHSA-2015:2657
RHEL 6 thunderbird 38.5.0-1.el6_7 RHSA-2016:0001
RHEL 5 firefox 38.5.0-2.el5_11 RHSA-2015:2657
RHEL 5 thunderbird 38.5.0-1.el5_11 RHSA-2016:0001
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Productivity 5 thunderbird 38.5.0-1.el5_11 RHSA-2016:0001

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP1 MozillaFirefox 38.5.0esr-54.1 SUSE-SU-2015:2335-1
SLES 12 MozillaFirefox 38.5.0esr-54.1 SUSE-SU-2015:2335-1
SLES 11 SP4 MozillaFirefox 38.5.0esr-28.2 SUSE-SU-2015:2334-1
SLES 11 SP3 MozillaFirefox 38.5.0esr-28.2 SUSE-SU-2015:2334-1
SLES 11 SP2 MozillaFirefox 38.5.0esr-28.2 SUSE-SU-2015:2336-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP1 MozillaFirefox 38.5.0esr-54.1 SUSE-SU-2015:2335-1
SLES for SAP 12 MozillaFirefox 38.5.0esr-54.1 SUSE-SU-2015:2335-1
SLES for SAP 11 SP4 MozillaFirefox 38.5.0esr-28.2 SUSE-SU-2015:2334-1
SLES for SAP 11 SP3 MozillaFirefox 38.5.0esr-28.2 SUSE-SU-2015:2334-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 50.1.0-1.1 openSUSE-SU-2024:10071-1
openSUSE Tumbleweed MozillaThunderbird 45.5.1-1.1 openSUSE-SU-2024:10230-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 firefox 38.5.0-3.0.1.el7_2 ELSA-2015-2657
Oracle Linux 7 thunderbird 38.5.0-1.0.1.el7_2 ELSA-2016-0001

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 14

References