Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ecr4-p51g-bygd
Vulnerability ID VCID-ecr4-p51g-bygd
Aliases CVE-2015-4505
Summary Security researcher Holger Fuhrmannek reported that when the Mozilla updater is run, the updater can be manipulated to load the updated files from a working directory under user control in concert with junctions. When the updates are run by the Mozilla Maintenance Service on Windows, these malicious files can be run with elevated privileges and be used to replace arbitrary files on the system. This could allow for arbitrary code execution by a malicious user with local system access but does not allow for exploitation by web content. This issue is specific to Windows and does not affect Linux or OS X systems.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2015-4505
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2015-4505
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2015-4505
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2015-4505
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2015-4505
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2015-4505
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2015-4505
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2015-4505
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2015-100
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-4505.json
https://api.first.org/data/v1/epss?cve=CVE-2015-4505
1265610 https://bugzilla.redhat.com/show_bug.cgi?id=1265610
CVE-2015-4505 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4505
mfsa2015-100 https://www.mozilla.org/en-US/security/advisories/mfsa2015-100
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.28621
EPSS Score 0.00105
Published At April 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:18:32.619488+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2015/mfsa2015-100.md 38.0.0