{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-03-31T00:00:00", "descriptions": [{"lang": "en", "value": "Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-12-30T15:57:01", "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1146339"}, {"name": "1031996", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1031996"}, {"name": "openSUSE-SU-2015:0892", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html"}, {"name": "GLSA-201512-10", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201512-10"}, {"name": "DSA-3212", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3212"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-40.html"}, {"name": "SUSE-SU-2015:0704", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html"}, {"name": "USN-2552-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2552-1"}, {"name": "RHSA-2015:0766", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0766.html"}, {"name": "73455", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/73455"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"name": "openSUSE-SU-2015:1266", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"name": "USN-2550-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2550-1"}, {"name": "1032000", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1032000"}, {"name": "openSUSE-SU-2015:0677", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html"}, {"name": "RHSA-2015:0771", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0771.html"}, {"name": "DSA-3211", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3211"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2015-0801", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1146339", "refsource": "CONFIRM", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1146339"}, {"name": "1031996", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1031996"}, {"name": "openSUSE-SU-2015:0892", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html"}, {"name": "GLSA-201512-10", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201512-10"}, {"name": "DSA-3212", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3212"}, {"name": "http://www.mozilla.org/security/announce/2015/mfsa2015-40.html", "refsource": "CONFIRM", "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-40.html"}, {"name": "SUSE-SU-2015:0704", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html"}, {"name": "USN-2552-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2552-1"}, {"name": "RHSA-2015:0766", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-0766.html"}, {"name": "73455", "refsource": "BID", "url": "http://www.securityfocus.com/bid/73455"}, {"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"name": "openSUSE-SU-2015:1266", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"name": "USN-2550-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2550-1"}, {"name": "1032000", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1032000"}, {"name": "openSUSE-SU-2015:0677", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html"}, {"name": "RHSA-2015:0771", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-0771.html"}, {"name": "DSA-3211", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3211"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:26:10.191Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1146339"}, {"name": "1031996", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1031996"}, {"name": "openSUSE-SU-2015:0892", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html"}, {"name": "GLSA-201512-10", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201512-10"}, {"name": "DSA-3212", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3212"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-40.html"}, {"name": "SUSE-SU-2015:0704", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html"}, {"name": "USN-2552-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2552-1"}, {"name": "RHSA-2015:0766", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0766.html"}, {"name": "73455", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/73455"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"name": "openSUSE-SU-2015:1266", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"name": "USN-2550-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2550-1"}, {"name": "1032000", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1032000"}, {"name": "openSUSE-SU-2015:0677", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html"}, {"name": "RHSA-2015:0771", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0771.html"}, {"name": "DSA-3211", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3211"}]}]}, "cveMetadata": {"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "cveId": "CVE-2015-0801", "datePublished": "2015-04-01T10:00:00", "dateReserved": "2015-01-07T00:00:00", "dateUpdated": "2024-08-06T04:26:10.191Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E600CCE-7BA3-410C-B089-9C7C27EE7D82", "versionEndIncluding": "36.0.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11F024A-A8B7-405B-8A13-4BF406FBDB22", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "D81A3698-797C-4CD9-BB02-A9182E0A6E11", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "84E8D7C7-B578-4623-9EA2-D13965DBE1F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "C3E5D043-71F8-4A61-BEA4-176153E26FD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "51CBE0A9-1D05-4F88-B5B5-1592D4A4687E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "902BF23B-C1B9-41F2-BF5D-C1722C3DBFFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDEF9754-B549-4AAC-926B-404143EA27FF", "versionEndIncluding": "31.5.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.1:*:*:*:*:*:*:*", "matchCriteriaId": "6D7AAC77-57A3-4747-B760-0EE3CD53E4DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.2:*:*:*:*:*:*:*", "matchCriteriaId": "7DCA6959-24B7-4F86-BE25-0A8A7C1A3D13", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.3:*:*:*:*:*:*:*", "matchCriteriaId": "697EA344-F982-4E9F-9EC8-CCCB5829582B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.4:*:*:*:*:*:*:*", "matchCriteriaId": "61304847-1DC8-442C-8194-28E52B3C1293", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.5:*:*:*:*:*:*:*", "matchCriteriaId": "8DF9724E-93B2-4BC7-8181-6D9521A6CC37", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC3823E9-1BAA-4402-95E2-7AF5B793DEBE", "versionEndIncluding": "31.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818."}, {"lang": "es", "value": "Mozilla Firefox anterior a 37.0, Firefox ESR 31.x anterior a 31.6, y Thunderbird anterior a 31.6 permiten a atacantes remotos evadir Same Origin Policy y ejecutar c\u00f3digo JavaScript arbitrario con privilegios chrome a trav\u00e9s de vectores que involucran la navegaci\u00f3n de anclajes (anchor), un problema similar a CVE-2015-0818."}], "id": "CVE-2015-0801", "lastModified": "2024-11-21T02:23:44.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-04-01T10:59:02.643", "references": [{"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"source": "[email protected]", "url": "http://rhn.redhat.com/errata/RHSA-2015-0766.html"}, {"source": "[email protected]", "url": "http://rhn.redhat.com/errata/RHSA-2015-0771.html"}, {"source": "[email protected]", "url": "http://www.debian.org/security/2015/dsa-3211"}, {"source": "[email protected]", "url": "http://www.debian.org/security/2015/dsa-3212"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-40.html"}, {"source": "[email protected]", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/bid/73455"}, {"source": "[email protected]", "url": "http://www.securitytracker.com/id/1031996"}, {"source": "[email protected]", "url": "http://www.securitytracker.com/id/1032000"}, {"source": "[email protected]", "url": "http://www.ubuntu.com/usn/USN-2550-1"}, {"source": "[email protected]", "url": "http://www.ubuntu.com/usn/USN-2552-1"}, {"source": "[email protected]", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1146339"}, {"source": "[email protected]", "url": "https://security.gentoo.org/glsa/201512-10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-0766.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-0771.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3211"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3212"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-40.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/73455"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1031996"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1032000"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-2550-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-2552-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1146339"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201512-10"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "[email protected]", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Mozilla project for reporting this issue. Upstream acknowledges Boris Zbarsky and Olli Pettay as the original reporters.", "affected_release": [{"advisory": "RHSA-2015:0766", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "firefox-0:31.6.0-2.el5_11", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2015-04-01T00:00:00Z"}, {"advisory": "RHSA-2015:0771", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "thunderbird-0:31.6.0-1.el5_11", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2015-04-01T00:00:00Z"}, {"advisory": "RHSA-2015:0766", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "firefox-0:31.6.0-2.el6_6", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2015-04-01T00:00:00Z"}, {"advisory": "RHSA-2015:0771", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "thunderbird-0:31.6.0-1.el6_6", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2015-04-01T00:00:00Z"}, {"advisory": "RHSA-2015:0766", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:31.6.0-2.el7_1", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2015-04-01T00:00:00Z"}, {"advisory": "RHSA-2015:0766", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "xulrunner-0:31.6.0-2.ael7b_1", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2015-04-01T00:00:00Z"}, {"advisory": "RHSA-2015:0771", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:31.6.0-1.el7_1", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2015-04-01T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Same-origin bypass through anchor navigation (MFSA 2015-40)", "id": "1207084", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1207084"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "status": "verified"}, "cwe": "CWE-358", "details": ["Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818."], "name": "CVE-2015-0801", "public_date": "2015-03-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2015-0801\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-0801\nhttp://www.mozilla.org/security/announce/2015/mfsa2015-40.html"], "threat_severity": "Moderate"}