PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefox | Dec 1, 2016 | Jul 5, 2015 |
| Freebsd | — | Upgrade thunderbirdUpgrade firefox-esrUpgrade seamonkeyUpgrade linux-seamonkeyUpgrade linux-firefoxUpgrade firefoxUpgrade libxulUpgrade linux-thunderbird | Dec 10, 2025 | Jul 16, 2015 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird.Upgrade www-client/firefox. | Oct 30, 2017 | Jul 5, 2015 |
| Mfsa2015 69 | — | Upgrade to Mozilla Firefox version 39.0Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 38.1Upgrade to Mozilla Firefox ESR version 31.8 | Jul 8, 2015 | Jul 5, 2015 |
| Oracle Solaris | — | Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade entire to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Jul 5, 2015 |
| Oracle_linux | — | Upgrade firefox | Oct 16, 2024 | Jul 6, 2015 |
| Suse | — | Upgrade libsoftokn3-debuginfo-x86Upgrade MozillaThunderbirdUpgrade libsoftokn3-32bitUpgrade firefox-gcc47Upgrade libsoftokn3-x86Upgrade MozillaThunderbird-buildsymbolsUpgrade MozillaThunderbird-debuginfoUpgrade MozillaFirefox-translationsUpgrade mozilla-nspr-debuginfo-x86Upgrade mozilla-nspr-x86Upgrade mozilla-nss-debuginfoUpgrade libfreebl3-debuginfo-x86Upgrade MozillaThunderbird-debugsourceUpgrade firefox-libgcc_s1Upgrade mozilla-nss-sysinit-32bitUpgrade libsoftokn3-debuginfo-32bitUpgrade MozillaFirefox-translations-commonUpgrade libfreebl3Upgrade MozillaFirefox-develUpgrade mozilla-nss-sysinitUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-develUpgrade libsoftokn3-debuginfoUpgrade mozilla-nspr-develUpgrade mozilla-nss-certs-x86Upgrade mozilla-nss-sysinit-debuginfo-x86Upgrade mozilla-nspr-debuginfo-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade MozillaFirefoxUpgrade libfreebl3-debuginfo-32bitUpgrade mozilla-nsprUpgrade mozilla-nss-debuginfo-x86Upgrade mozilla-nss-sysinit-debuginfoUpgrade firefox-libstdc++6Upgrade libsoftokn3-hmac-32bitUpgrade mozilla-nss-sysinit-debuginfo-32bitUpgrade libsoftokn3-hmacUpgrade mozilla-nss-certsUpgrade mozilla-nss-toolsUpgrade mozilla-nss-32bitUpgrade mozillafirefox-branding-upstreamUpgrade libfreebl3-debuginfoUpgrade libfreebl3-hmacUpgrade mozilla-nss-debugsourceUpgrade MozillaThunderbird-translations-commonUpgrade libfreebl3-x86Upgrade mozilla-nss-debuginfo-32bitUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nss-sysinit-x86Upgrade mozilla-nss-certs-debuginfo-32bitUpgrade MozillaFirefox-debugsourceUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-debuginfoUpgrade libfreebl3-32bitUpgrade mozilla-nss-x86Upgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-tools-debuginfoUpgrade mozilla-nspr-debugsourceUpgrade mozillafirefox-buildsymbolsUpgrade libsoftokn3Upgrade mozilla-nspr-debuginfoUpgrade mozilla-nssUpgrade mozilla-nss-certs-debuginfo-x86Upgrade libfreebl3-hmac-32bitUpgrade mozilla-nss-certs-debuginfoUpgrade MozillaThunderbird-devel | May 18, 2016 | Jul 5, 2015 |
| Ubuntu | — | Upgrade firefox | Nov 8, 2024 | Jul 6, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub