PT-2015-1901 · Mozilla · Firefox Os

Paul Theriault + 1 · Publicado 2015-08-06 · Atualizado 2015-08-10 · CVE-2015-4494

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox OS versions prior to 2.2

Description The issue is related to the lack of protection for system messages in Firefox OS, allowing attackers to obtain potentially sensitive information via a crafted app. This could enable a remote attacker to access protected information contained in system messages.

Recommendations For Mozilla Firefox OS versions prior to 2.2, consider restricting access to system messages or disabling the ability to read these messages until a patch is available. As a temporary workaround, avoid using crafted apps that could exploit this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2015-11247

CVE-2015-4494

Produtos afetados

Firefox Os

Referências · 4

• http://mozilla.org/security/announce/2015/mfsa2015-76.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-4494 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11247 · Nota de Segurança
• https://bugzilla.mozilla.org/show_bug.cgi?id=1138808 · Nota