A flaw was discovered in Mozilla Firefox that could be used to violate the same-origin policy and inject web script into a non-privileged part of the built-in PDF file viewer (PDF.js). An attacker could create a malicious web page that, when viewed by a victim, could steal arbitrary files (including private SSH keys, the /etc/passwd file, and other potentially sensitive files) from the system running Firefox.
Security researcher Cody Crews reported on a way to violate the same origin policy and inject script into a non-privileged part of the built-in PDF Viewer. This would allow an attacker to read and steal sensitive local files on the victim's computer.
Mozilla has received reports that an exploit based on this vulnerability has been found in the wild.
Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Cody Crews as the original reporter.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 5
Via RHSA-2015:1581 https://rhn.redhat.com/errata/RHSA-2015-1581.html
The Firefox package shipped with Red Hat Enterprise Linux 5, 6 and 7 is not confined by selinux (runs in unconfined_t domain). Processes running in unconfined_t domain get complete access to the system and are only restricted by the conventional DAC system. (restricted by file system permissions, acls etc)
This security flaw could therefore be exploited to steal files, which the user running firefox has access to, and cannot be mitigated by enabling selinux.
There are several resources available which deal which confining firefox by using selinux (with different success rates):