CVE-2015-4481

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 0.8%

from disclosure to weapon5 days

Published on NVDAug 16

1st PoC+5d

exploitation probability

0.8%top 47% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/37925 cve_referencewww.exploit-db.com/exploits/37925/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html https://bugzilla.mozilla.org/show_bug.cgi?id=1171518 https://security.gentoo.org/glsa/201605-06 https://www.exploit-db.com/exploits/37925/http://www.mozilla.org/security/announce/2015/mfsa2015-84.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securitytracker.com/id/1033247 http://www.securitytracker.com/id/1033372