CVE:CVE-2015-4490
CNNVD:CNNVD-201508-353
Mozilla Firefox是美国Mozilla基金会开发的一款开源Web浏览器。
Mozilla Firefox 40.0之前版本的dom/security/nsCSPUtils.cpp文件中的‘nsCSPHostSrc::permits’函数存在安全漏洞，该漏洞源于程序匹配通配符source-expression时没有正确处理blob:、data:和filesystem: URL的Content Security Policy Level 2异常。远程攻击者可借助policy-enforcement操作利用该漏洞实施跨站脚本攻击。
solution:Upgrade mozilla firefox to a higher version than 39.0.3,and avoid the version (,39.0.3]; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,15.04,and avoid the version 12.04,14.04,15.04; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2; Upgrade oracle solaris to a higher version than 11.3,and avoid the version 11.3