CVE-2015-4518
- State
- Published
- Severity
- Not scored
- Published
- Nov 5, 2015
- Updated
- Aug 6, 2024
- Reserved
- Jun 10, 2015
Description
The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism and conduct cross-site scripting (XSS) attacks via vectors involving SVG animations and the about:reader URL.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 1034069vdb-entry
- GLSA-201512-10vendor-advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-118.html
- USN-2785-1vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1136692
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- openSUSE-SU-2015:1942vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1182778
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.