PT-2015-5849 · Mozilla+2 · Firefox+2

Publicado 2015-05-12 · Atualizado 2024-12-12 · CVE-2015-2711

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 38.0

Description The issue allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL. This occurs when a referrer policy delivered by a referrer META element is not recognized in cases of context-menu navigation and middle-click navigation.

Recommendations For versions prior to 38.0, update to version 38.0 or later to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2015-1463

ALT-PU-2015-1464

CVE-2015-2711

MGASA-2015-0342

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

USN-2602-1

Produtos afetados

Alt Linux

Firefox

Ubuntu

Referências · 2220

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proxy_prototype.rb · Exploit
• https://suse.com/security/cve/CVE-2009-0354 · Nota
• https://bdu.fstec.ru/vul/2015-09904 · Nota de Segurança
• https://suse.com/security/cve/CVE-2024-3302 · Nota
• https://suse.com/security/cve/CVE-2024-1551 · Nota
• https://suse.com/security/cve/CVE-2012-1937 · Nota
• https://suse.com/security/cve/CVE-2023-25731 · Nota
• https://suse.com/security/cve/CVE-2009-1307 · Nota
• https://suse.com/security/cve/CVE-2020-6812 · Nota
• https://suse.com/security/cve/CVE-2024-4769 · Nota
• https://suse.com/security/cve/CVE-2016-5282 · Nota
• https://suse.com/security/cve/CVE-2010-1210 · Nota
• https://suse.com/security/cve/CVE-2009-3381 · Nota
• https://security.gentoo.org/glsa/201605-06 · Aviso do Fabricante