CVE-2015-4490

Published: 11 August 2015

The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4490
• https://www.mozilla.org/en-US/security/advisories/mfsa2015-91/
• https://ubuntu.com/security/notices/USN-2702-1
• NVD
• Launchpad
• Debian