CVE-2015-4495
Redhat Enterprise Linux Eus 6.7 … 7.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2015-4495 is a high-severity Origin Validation Error (CWE-346) vulnerability in Redhat Enterprise Linux Eus. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is a same-origin policy bypass in the PDF reader component of Mozilla Firefox before version 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2. It is triggered by specially crafted JavaScript that interacts with a native setter, allowing violation of origin boundaries. The issue is tracked as CVE-2015-4495 with a CVSS 3.1 score of 8.8 and is associated with CWE-346.
Remote attackers can exploit the flaw by serving a malicious PDF that executes in the browser or Firefox OS environment. Successful exploitation permits reading arbitrary local files and obtaining elevated privileges without requiring authentication, though user interaction is needed to open the document. The vulnerability was observed being exploited in the wild during August 2015.
Advisories from openSUSE detail the availability of updated Firefox packages that resolve the issue for affected distributions, recommending immediate application of the patches listed in the August 2015 security announcements. The flaw's public exploitation at the time of disclosure underscores the need for rapid deployment of the fixes across all supported Firefox versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2015-4515
Vulnerability Data
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code…
more
and a native setter, as exploited in the wild in August 2015.
- CWE(s)
- KEV Date Added
- 25 May 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires unique identification of the service before communications, addressing failures to validate the origin of the interaction.
Trusted path establishment enforces validation that the communication originates from and reaches only the intended trusted system components.
Enforces validation of the true origin of DNS responses via signatures and chain-of-trust mechanisms.
Enforces origin validation of name/address data, eliminating reliance on unverified or impersonated DNS sources.
Mandates origin validation so that only legitimate endpoints can continue the authenticated session.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls enforce origin validation at network boundaries.
Security of network services includes validating the authenticity of service endpoints.
A.8.26 requires identifying and specifying requirements for resilience against malicious attacks including SQL injections and input validation (items d, j), plus related protections (authentication, segregation, cryptography per 8.24), which can address some but not most origin validation scenarios such as those involving untrusted cross-origin requests or implicit trust in sources.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, zero-trust verification) plus design reviews that can catch and block origin-validation gaps in many common cases, but leaves a bounded remainder (e.g. protocol-level or third-party component origin errors not surfaced by the organization's review process).
Secure coding practices include implementing proper origin validation to prevent spoofing.
Secure authentication verifies identity but does not address origin validation of arbitrary data flows.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-346, a class-level weakness, and none of its children carries one either.