The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

The remote host is affected by the vulnerability described in GLSA-201512-10 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox and       Mozilla Thunderbird. Please review the CVE identifiers referenced below       for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Versions of Firefox OS prior to 2.2 are outdated and thus unpatched for the following vulnerabilities : 

 - A logic error in 'apps/system/js/usb_storage.js' that is triggered during the handling of USB mass storage. This may allow a local attacker with access to the USB host to gain access to USB media volumes that are locked with a passcode after a reboot or certain unspecified screen saver state changes. (CVE-2015-5960) 
 - A flaw exists in the SharedBufferManagerParent::RecvAllocateGrallocBuffer() function in 'gfx/layers/ipc/SharedBufferManagerParent.cpp'. This may allow an attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code. (CVE-2015-5960) 
 - A flaw exists in the 'FxAccounts signup dialog' that is triggered as input passed via the COPPA error screen is not properly sanitized before being passed to the B2G root process. This may allow a remote attacker to inject arbitrary web content into the B2G root process. (CVE-2015-5961) 
 - A flaw exists in 'dom/messages/SystemMessagePermissionsChecker.jsm' within the WiFi-related system message, as the system fails to restrict system messages to applications with the 'wifi-manage' permissions. With an unprivileged application, a local attacker can gain access to limited information from system messages. (CVE-2015-4494) 
 - A use-after-free error affects the StyleAnimationValue::operator=() function in 'layout/style/StyleAnimationValue.cpp'. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-4488) 
 - An unspecified flaw exists in the nsTArray_Impl() function. The issue is triggered as user-supplied input is not properly validated during self-assignment. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-4489) 
 - An overflow condition affects the nsTSubstring::ReplacePrep() function. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2015-4487) 
 - Gaia contains a flaw in the search app within 'apps/search/js/providers/provider.js' that is triggered during the handling of a specially crafted search link. When the link is opened in the browser and the browser is re-opened or a new tab is opened, a context-dependent attacker can potentially inject HTML content. (CVE-2015-2744) 
 - Gaia contains a flaw in 'apps/system/js/card.js' that is triggered when handling titles. When the link is opened in the browser and the HOME button is pressed or the Show Windows function is used, a context-dependent attacker can potentially inject HTML content. (CVE-2015-2745) 
 - A flaw affects the nsDocShell::LoadURI() function in 'docshell/base/nsDocShell.cpp' that is triggered when converting an expanded principal into inheriting the current principal. This may allow a context-dependent attacker to bypass the same-origin policy and disclose the contents of local files. (CVE-2015-4495)

Mozilla Firefox is being updated to the current Firefox 38ESR branch (specifically the 38.2.0ESR release).

Security issues fixed :

  - MFSA 2015-78 / CVE-2015-4495: Same origin violation and     local file stealing via PDF reader

  - MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474:
    Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

  - MFSA 2015-80 / CVE-2015-4475: Out-of-bounds read with     malformed MP3 file

  - MFSA 2015-82 / CVE-2015-4478: Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83 / CVE-2015-4479: Overflow issues in     libstagefright

  - MFSA 2015-87 / CVE-2015-4484: Crash when using shared     memory in JavaScript

  - MFSA 2015-88 / CVE-2015-4491: Heap overflow in     gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486: Buffer     overflows on Libvpx when decoding WebM video

  - MFSA 2015-90 /     CVE-2015-4487/CVE-2015-4488/CVE-2015-4489:
    Vulnerabilities found through code inspection

  - MFSA 2015-92 / CVE-2015-4492: Use-after-free in     XMLHttpRequest with shared workers

This update also contains a lot of feature improvements and bug fixes from 31ESR to 38ESR.

Also the Mozilla NSS library switched its CKBI API from 1.98 to 2.4, which is what Firefox 38ESR uses.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mozilla Firefox is prior to 40.0 and is affected by multiple vulnerabilities : 

 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4473) 
 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4474) 
 - An out-of-bounds read error exists in the 'PlayFromAudioQueue()' function due to improper handling of mismatched sample formats. A remote attacker can exploit this, via a specially crafted MP3 file, to disclose memory contents or execute arbitrary code. (CVE-2015-4475) 
 - A use-after-free error exists in the Web Audio API during MediaStream playback. A remote attacker can exploit this to dereference already freed memory, resulting in the potential execution of arbitrary code. (CVE-2015-4477) 
 - A same-origin policy bypass vulnerability exists due to non-configurable properties being redefined in violation of the ECMAScript 6 standard during JSON parsing. A remote attacker can exploit this, by editing these properties to arbitrary values, to bypass the same-origin policy. (CVE-2015-4478) 
 - Multiple integer overflow conditions exist due to improper validation of user-supplied input when handling 'saio' chunks in MPEG4 video. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4479) 
 - An integer overflow condition exists in the bundled libstagefright component when handling H.264 media content. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4480) 
 - An arbitrary file overwrite vulnerability exists in the Mozilla Maintenance Service due to a race condition. An attacker can exploit this, via the use of a hard link, to overwrite arbitrary files with log output. (CVE-2015-4481) 
 - An out-of-bounds write error exists due to an array indexing flaw in the 'mar_consume_index()' function when handling index names in MAR files. An attacker can exploit this to execute arbitrary code. (CVE-2015-4482) 
 - A security bypass vulnerability exists due to a flaw in the 'ShouldLoad()' function that occurs during the handling of POST requests to URLs using the 'feed:' URI handler. An attacker can exploit this to bypass the mixed content blocker. (CVE-2015-4483) 
 - A denial of service vulnerability exists when handling JavaScript using shared memory without properly gating access to Atomics and SharedArrayBuffer views. An attacker can exploit this to crash the program, resulting in a denial of service condition. (CVE-2015-4484) 
 - A heap-based buffer overflow condition exists in the  'resize_context_buffers()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4485) 
 - A heap-based buffer overflow condition exists in the 'decrease_ref_count()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4486) 
 - A buffer overflow condition exists in the 'ReplacePrep()' function. A remote attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4487) 
 - A use-after-free error exists in the 'operator=()' function. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4488) 
 - A memory corruption issue exists in the 'nsTArray_Impl()' function due to improper validation of user-supplied input during self-assignment. An attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2015-4489) 
 - A security bypass vulnerability exists due to a discrepancy in the implementation of Content Security Policy and the CSP specification. The specification states that 'blob:', 'data:', and 'filesystem:' URLs should be excluded in case of a wildcard when matching source expressions, but Mozilla's implementation allows these in the case of an asterisk wildcard. A remote attacker can exploit this to bypass restrictions. (CVE-2015-4490) 
 - A use-after-free error exists in the 'XMLHttpRequest::Open()' function due to improper handling of recursive calls. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4492) 
 - An integer underflow condition exists in the bundled libstagefright library. An attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-4493) 
 - A flaw in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files. (CVE-2015-4495)

Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities.

  - Firefox was updated to 38.2.1 ESR (bsc#943608)

  - MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free     when resizing canvas element during restyling

  - MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on     notification bypass through data URLs

  - Firefox was updated to 38.2.0 ESR (bsc#940806)

  - MFSA 2015-78/CVE-2015-4495 (bmo#1178058, bmo#1179262)     Same origin violation and local file stealing via PDF     reader

  - MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 (bmo#1143130,     bmo#1161719, bmo#1177501, bmo#1181204, bmo#1184068,     bmo#1188590, bmo#1146213, bmo#1178890, bmo#1182711)     Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

  - MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds     read with malformed MP3 file

  - MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83/CVE-2015-4479 (bmo#1185115, bmo#1144107,     bmo#1170344, bmo#1186718) Overflow issues in     libstagefright

  - MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when     using shared memory in JavaScript

  - MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow     in gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948,     bmo#1178148) Buffer overflows on Libvpx when decoding     WebM video

  - MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489     (bmo#1176270, bmo#1182723, bmo#1171603) Vulnerabilities     found through code inspection

  - MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free     in XMLHttpRequest with shared workers

Mozilla NSS switched the CKBI ABI from 1.98 to 2.4, which is what Firefox 38ESR uses.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox is being updated to the current Firefox 38ESR branch (specifically the 38.2.0ESR release).

Security issues fixed :

  - MFSA 2015-78 / CVE-2015-4495: Same origin violation and     local file stealing via PDF reader

  - MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474:
    Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

  - MFSA 2015-80 / CVE-2015-4475: Out-of-bounds read with     malformed MP3 file

  - MFSA 2015-82 / CVE-2015-4478: Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83 / CVE-2015-4479: Overflow issues in     libstagefright

  - MFSA 2015-87 / CVE-2015-4484: Crash when using shared     memory in JavaScript

  - MFSA 2015-88 / CVE-2015-4491: Heap overflow in     gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486: Buffer     overflows on Libvpx when decoding WebM video

  - MFSA 2015-90 /     CVE-2015-4487/CVE-2015-4488/CVE-2015-4489:
    Vulnerabilities found through code inspection

  - MFSA 2015-92 / CVE-2015-4492: Use-after-free in     XMLHttpRequest with shared workers

The following vulnerabilities were fixed in ESR31 and are also included here :

  - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous     memory safety hazards (bsc#935979).

  - CVE-2015-2728: Type confusion in Indexed Database     Manager (bsc#935979).

  - CVE-2015-2730: ECDSA signature validation fails to     handle some signatures correctly (bsc#935979).

  - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers     while using XMLHttpRequest (bsc#935979).
    CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/     CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740:
    Vulnerabilities found through code inspection     (bsc#935979).

  - CVE-2015-2743: Privilege escalation in PDF.js     (bsc#935979).

  - CVE-2015-4000: NSS accepts export-length DHE keys with     regular DHE cipher suites (bsc#935033).

  - CVE-2015-2721: NSS incorrectly permits skipping of     ServerKeyExchange (bsc#935979).

This update also contains a lot of feature improvements and bug fixes from 31ESR to 38ESR.

Also the Mozilla NSS library switched its CKBI API from 1.98 to 2.4, which is what Firefox 38ESR uses.

Mozilla Firefox and mozilla-nss were updated to fix 17 security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- update to Firefox 40.0 (bnc#940806)

  - Added protection against unwanted software downloads

  - Suggested Tiles show sites of interest, based on     categories from your recent browsing history

  - Hello allows adding a link to conversations to provide     context on what the conversation will be about

  - New style for add-on manager based on the in-content     preferences style

  - Improved scrolling, graphics, and video playback     performance with off main thread compositing (GNU/Linux     only)

  - Graphic blocklist mechanism improved: Firefox version     ranges can be specified, limiting the number of devices     blocked security fixes :

  - MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 Miscellaneous     memory safety hazards

  - MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds     read with malformed MP3 file

  - MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free     in MediaStream playback

  - MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of     non-configurable JavaScript object properties

  - MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493     Overflow issues in libstagefright

  - MFSA 2015-84/CVE-2015-4481 (bmo1171518) Arbitrary file     overwriting through Mozilla Maintenance Service with     hard links (only affected Windows)

  - MFSA 2015-85/CVE-2015-4482 (bmo#1184500) Out-of-bounds     write with Updater and malicious MAR file (does not     affect openSUSE RPM packages which do not ship the     updater)

  - MFSA 2015-86/CVE-2015-4483 (bmo#1148732) Feed protocol     with POST bypasses mixed content protections

  - MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when     using shared memory in JavaScript

  - MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow     in gdk-pixbuf when scaling bitmap images

  - MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948,     bmo#1178148) Buffer overflows on Libvpx when decoding     WebM video

  - MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489     Vulnerabilities found through code inspection

  - MFSA 2015-91/CVE-2015-4490 (bmo#1086999) Mozilla Content     Security Policy allows for asterisk wildcards in     violation of CSP specification

  - MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free     in XMLHttpRequest with shared workers

  - added mozilla-no-stdcxx-check.patch

  - removed obsolete patches

  - mozilla-add-glibcxx_use_cxx11_abi.patch

  - firefox-multilocale-chrome.patch

  - rebased patches

  - requires version 40 of the branding package

  - removed browser/searchplugins/ location as it's not     valid anymore

  - includes security update to Firefox 39.0.3 (bnc#940918)

  - MFSA 2015-78/CVE-2015-4495 (bmo#1179262, bmo#1178058)     Same origin violation and local file stealing via PDF     reader

This security update (bsc#940918) fixes the following issues :

  - MFSA 2015-78 (CVE-2015-4495, bmo#1178058): Same origin     violation

  - Remove PlayPreview registration from PDF Viewer     (bmo#1179262)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This security update (bsc#940918) fixes the following issues :

  - MFSA 2015-78: (CVE-2015-4495, bmo#1178058): Same origin     violation

  - Remove PlayPreview registration from PDF Viewer     (bmo#1179262)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated firefox packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

A flaw was discovered in Mozilla Firefox that could be used to violate the same-origin policy and inject web script into a non-privileged part of the built-in PDF file viewer (PDF.js). An attacker could create a malicious web page that, when viewed by a victim, could steal arbitrary files (including private SSH keys, the /etc/passwd file, and other potentially sensitive files) from the system running Firefox.
(CVE-2015-4495)

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Cody Crews as the original reporter.

All Firefox users should upgrade to these updated packages, which contain Firefox version 38.1.1 ESR, which corrects this issue. After installing the update, Firefox must be restarted for the changes to take effect.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2707-1 advisory.

    Cody Crews discovered a way to violate the same-origin policy to inject script in to a non-privileged part     of the PDF viewer. If a user were tricked in to opening a specially crafted website, an attacker could     exploit this to read sensitive information from local files. (CVE-2015-4495)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was discovered in Mozilla Firefox that could be used to violate the same-origin policy and inject web script into a non-privileged part of the built-in PDF file viewer (PDF.js). An attacker could create a malicious web page that, when viewed by a victim, could steal arbitrary files (including private SSH keys, the /etc/passwd file, and other potentially sensitive files) from the system running Firefox.
(CVE-2015-4495)

After installing the update, Firefox must be restarted for the changes to take effect.

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2015-1581 advisory.

    [38.1.1-1.0.1]
    - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html       and remove the corresponding Red Hat files

    [38.1.1-1]
    - Update to 38.1.1 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Mozilla Project reports :

MFSA 2015-78 Same origin violation and local file stealing via PDF reader

The version of Firefox installed on the remote Windows host is prior to 39.0.3. It is, therefore, affected by a vulnerability in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files.

The version of Firefox ESR installed on the remote Windows host is prior to 38.1.1. It is, therefore, affected by a vulnerability in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files.

The version of Firefox installed on the remote Mac OS X host is prior to 39.0.3. It is, therefore, affected by a vulnerability in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files.

The version of Firefox ESR installed on the remote Mac OS X host is prior to 38.1.1. It is, therefore, affected by a vulnerability in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files.

ID	Name	Product	Family	Severity
87710	GLSA-201512-10 : Mozilla Products: Multiple vulnerabilities (Bar Mitzvah) (Logjam)	Nessus	Gentoo Local Security Checks	critical
8878	Firefox OS < 2.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
85906	SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1528-1)	Nessus	SuSE Local Security Checks	critical
8856	Mozilla Firefox < 40.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
85763	SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1476-1)	Nessus	SuSE Local Security Checks	critical
85721	SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1449-1) (Logjam)	Nessus	SuSE Local Security Checks	low
85437	openSUSE Security Update : MozillaFirefox (openSUSE-2015-548)	Nessus	SuSE Local Security Checks	critical
85436	openSUSE Security Update : MozillaFirefox (openSUSE-2015-547)	Nessus	SuSE Local Security Checks	critical
85401	SUSE SLED11 / SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:1380-1)	Nessus	SuSE Local Security Checks	medium
85400	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:1379-1)	Nessus	SuSE Local Security Checks	medium
85306	CentOS 5 / 6 / 7 : firefox (CESA-2015:1581)	Nessus	CentOS Local Security Checks	medium
85297	Ubuntu 14.04 LTS : Firefox vulnerability (USN-2707-1)	Nessus	Ubuntu Local Security Checks	high
85296	Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150807)	Nessus	Scientific Linux Local Security Checks	medium
85295	RHEL 5 / 6 / 7 : firefox (RHSA-2015:1581)	Nessus	Red Hat Local Security Checks	medium
85294	Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1581)	Nessus	Oracle Linux Local Security Checks	high
85293	FreeBSD : mozilla -- multiple vulnerabilities (8eee06d4-c21d-4f07-a669-455151ff426f)	Nessus	FreeBSD Local Security Checks	medium
85275	Firefox < 39.0.3 PDF Reader Arbitrary File Access	Nessus	Windows	medium
85274	Firefox ESR < 38.1.1 PDF Reader Arbitrary File Access	Nessus	Windows	medium
85273	Firefox < 39.0.3 PDF Reader Arbitrary File Access (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
85272	Firefox ESR < 38.1.1 PDF Reader Arbitrary File Access (Mac OS X)	Nessus	MacOS X Local Security Checks	medium

Detections

Analytics

CVE-2015-4495

high

Tenable Plugins

critical

critical

critical

critical

critical

low

critical

critical

medium

medium

medium

high

medium

medium

high

medium

medium

medium

medium

medium