Security researcher Cody Crews reported on a way to violate the same origin policy and inject script into a non-privileged part of the built-in PDF Viewer. This would allow an attacker to read and steal sensitive local files on the victim's computer. Mozilla has received reports that an exploit based on this vulnerability has been found in the wild. External References: https://www.mozilla.org/security/announce/2015/mfsa2015-78.html https://access.redhat.com/articles/1563163 https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ Acknowledgements: Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Cody Crews as the original reporter.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Via RHSA-2015:1581 https://rhn.redhat.com/errata/RHSA-2015-1581.html
Note: The Firefox package shipped with Red Hat Enterprise Linux 5, 6 and 7 is not confined by selinux (runs in unconfined_t domain). Processes running in unconfined_t domain get complete access to the system and are only restricted by the conventional DAC system. (restricted by file system permissions, acls etc) This security flaw could therefore be exploited to steal files, which the user running firefox has access to, and cannot be mitigated by enabling selinux. There are several resources available which deal which confining firefox by using selinux (with different success rates): http://people.redhat.com/tscherf/articles/lm_en_selinux.pdf http://danwalsh.livejournal.com/15700.html http://danwalsh.livejournal.com/28545.html