Firefox OS vulnerabilitiesAnd the versions its exploited flaws hit.
Firefox OS is made by Mozilla. We track 14 published vulnerabilities in it, across 2 versions. 1 of them is on the list of flaws known to be exploited, the newest added on 25 May 2022. If you run Firefox OS, check your version against the exploited flaws below and patch those first.
The most recent Firefox OS flaw added to the known-exploited list is CVE-2015-4495, on 25 May 2022. We keep watching the known-exploited list.
Which versions of Firefox OS do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "before 2.2" means every version up to, but not including, 2.2. Find your version, then patch.
- CVE-2015-4495Exploited list, 25 May 2022
Mozilla Firefox Security Feature Bypass Vulnerability
before 2.2
Which Firefox OS vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 8.8Mozilla Firefox Security Feature Bypass Vulnerability
Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.
Which Firefox OS flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct...
- 69%
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via...
- 3.8%CVE-2015-4487High
The nsTSubstring::ReplacePrep function in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly...
- 3.8%CVE-2015-4488High
Use-after-free vulnerability in the StyleAnimationValue class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 allows remote attackers to have an unspecified impact by...
- 3.6%CVE-2015-4489High
The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have...
- 1.4%CVE-2015-2745Medium
Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content...
- 1.1%CVE-2015-5962Medium
Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS before 2.2 might allow attackers to...
- 0.8%CVE-2015-2744Medium
Cross-site scripting (XSS) vulnerability in the Search app in Gaia in Mozilla Firefox OS before 2.2 allows remote attackers to inject arbitrary HTML via a crafted search link that is mishandled after re-opening the...
- 0.8%CVE-2015-4494Medium
Mozilla Firefox OS before 2.2 does not require the wifi-manage privilege for reading a Wi-Fi system message, which allows attackers to obtain potentially sensitive information via a crafted app.
- 0.7%CVE-2015-8510Medium
Cross-site scripting (XSS) vulnerability in the internationalization feature in the default homescreen app in Mozilla Firefox OS before 2.5 allows user-assisted remote attackers to inject arbitrary web script or HTML...
Running Firefox OS? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.
- Matched to
- Firefox OS on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 14 published vulnerabilities listed under the name Firefox OS, across 2 versions. The most recent Firefox OS flaw added to the known-exploited list is CVE-2015-4495, on 25 May 2022.
1 is on the list of flaws known to be exploited. The most recently added is CVE-2015-4495.
Each flaw names its own versions, usually as ranges. The newest, CVE-2015-4495, affects before 2.2. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Firefox OS. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.