| ID |
CVE-2015-0812
|
| Summary |
Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain. |
| References |
|
| Vulnerable Configurations |
-
cpe:2.3:a:mozilla:firefox:36.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:36.0.4:*:*:*:*:*:*:*
-
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
-
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
-
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
-
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
-
cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
|
| CVSS |
| Base: | 4.3 (as of 30-10-2018 - 16:27) |
| Impact: | |
| Exploitability: | |
|
| CWE |
CWE-17 |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
MEDIUM |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| NONE |
PARTIAL |
NONE |
|
| cvss-vector
via4
|
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
| refmap
via4
|
| confirm | | | gentoo | GLSA-201512-10 | | sectrack | 1031996 | | suse | openSUSE-SU-2015:0677 | | ubuntu | USN-2550-1 |
|
| Last major update |
30-10-2018 - 16:27 |
| Published |
01-04-2015 - 10:59 |
| Last modified |
30-10-2018 - 16:27 |
