CVE-2015-4505: Mozilla Firefox

Medium severity, CVSS 6.6. EPSS: 0.3% chance of exploitation in the next 30 days.

updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.

Affected products

• Mozilla Firefox: version 38.0 only; version 38.0.1 only; version 38.0.5 only; version 38.1.0 only; version 38.1.1 only; version 38.2.0 only; …

Published 2015-09-24. Last modified 2026-06-17.