CVE-2015-4490
Fixed in a distro release EPSS 2%
The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.
Products: mozilla firefox, canonical ubuntu_linux, opensuse, oracle solaris
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 14.04 LTS | firefox | 40.0+build4-0ubuntu0.14.04.1 |
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |