CVE-2015-0801

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-04-01 · updated 2026-06-17
Weakness: CWE-264

Description

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.

Affected products

Mozilla Firefox: through 31.5.3; through 36.0.4; 31.0, 31.1.0, 31.1.1, 31.3.0, 31.5.1, 31.5.2
Mozilla Firefox ESR: 31.1, 31.2, 31.3, 31.4, 31.5
Mozilla Thunderbird: through 31.5

References

http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
http://rhn.redhat.com/errata/RHSA-2015-0766.html
http://rhn.redhat.com/errata/RHSA-2015-0771.html
http://www.debian.org/security/2015/dsa-3211
http://www.debian.org/security/2015/dsa-3212
http://www.mozilla.org/security/announce/2015/mfsa2015-40.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
http://www.securityfocus.com/bid/73455
http://www.securitytracker.com/id/1031996

Get alerted when CVE-2015-0801 or the next vulnerability affects your stack