CVE-2015-0802: Canonical Ubuntu Linux

Medium severity, CVSS 5.0. EPSS: 67.3% chance of exploitation in the next 30 days.

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 14.10 only
• Mozilla Firefox: up to and including 36.0.4
• Opensuse Opensuse: version 13.1 only; version 13.2 only

Published 2015-04-01. Last modified 2026-06-17.