CVE-2015-4478

Published: 11 August 2015

Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 do not impose certain ECMAScript 6 requirements on JavaScript object properties, which allows remote attackers to bypass the Same Origin Policy via the reviver parameter to the JSON.parse method.

Status

References

• https://www.mozilla.org/en-US/security/advisories/mfsa2015-82/
• https://ubuntu.com/security/notices/USN-2702-1
• https://www.cve.org/CVERecord?id=CVE-2015-4478
• NVD
• Launchpad
• Debian