CVE-2015-4481 - Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update

Back Back to CVE browser

LOW

Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update

Published Aug 16, 2015

3.3

LOW

CVSS 2.0

EPSS 0.80%

Description

Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-362

Race Condition

References (12)

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html
vendor-advisoryx_refsource_SUSEThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html
vendor-advisoryx_refsource_SUSEThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html
vendor-advisoryx_refsource_SUSE
http://www.mozilla.org/security/announce/2015/mfsa2015-84.html
x_refsource_CONFIRMVendor Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
x_refsource_CONFIRMThird Party Advisory
http://www.securitytracker.com/id/1033247
vdb-entryx_refsource_SECTRACK
http://www.securitytracker.com/id/1033372
vdb-entryx_refsource_SECTRACK
https://bugzilla.mozilla.org/show_bug.cgi?id=1171518
x_refsource_CONFIRMIssue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-4501
Advisory
https://security.gentoo.org/glsa/201605-06
vendor-advisoryx_refsource_GENTOO
https://www.exploit-db.com/exploits/37925/
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html		vendor-advisoryx_refsource_SUSEThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html		vendor-advisoryx_refsource_SUSEThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html		vendor-advisoryx_refsource_SUSE
http://www.mozilla.org/security/announce/2015/mfsa2015-84.html		x_refsource_CONFIRMVendor Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html		x_refsource_CONFIRMThird Party Advisory
http://www.securitytracker.com/id/1033247		vdb-entryx_refsource_SECTRACK
http://www.securitytracker.com/id/1033372		vdb-entryx_refsource_SECTRACK
https://bugzilla.mozilla.org/show_bug.cgi?id=1171518		x_refsource_CONFIRMIssue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-4501		Advisory
https://security.gentoo.org/glsa/201605-06		vendor-advisoryx_refsource_GENTOO
https://www.exploit-db.com/exploits/37925/		exploitx_refsource_EXPLOIT-DB