« Volver al listado

CVE-2015-4505

Estado: ModificadaMedia (6.6)—

Vulnerabilidad en updater.exe en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3 en Windows, permite a usuarios locales escribir en archivos arbitrarios mediante la realización de un ataque de unión y esperando por una operación de actualización por el Mozilla Maintenance Service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mozilla — Firefox

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-4505",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 9.2,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-09-24T04:59:08.223",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-100.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1033640",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1177861",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-100.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1033640",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1177861",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en updater.exe en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3 en Windows, permite a usuarios locales escribir en archivos arbitrarios mediante la realización de un ataque de unión y esperando por una operación de actualización por el Mozilla Maintenance Service."
    }
  ],
  "lastModified": "2026-06-17T00:27:25.643",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35BF0AFB-26BA-4BEA-B6B8-11CF88E951DE"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F007CC6-9391-4E1C-A747-F3DE5E572FA5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45E9641F-430C-4B3A-BD63-EC13DBD3D1E4"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AADD23B-A8AF-4679-990D-C29A1D6EB5CD"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1343A1FD-98CF-4A6C-A697-1253E538FD5C"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D098567-B55E-4EAC-8FAA-31FAFDD4058F"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE0389BC-D295-4957-8AE7-EDAC770F596D"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4EE7B0EF-4A3A-4353-8B50-6F28B5CADBDB",
              "versionEndIncluding": "40.0.3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}