PT-2014-4215 · Mozilla · Firefox

Roee Hay · Published 2014-03-25 · Updated 2014-04-01 · CVE-2014-1515

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 28.0.1 on Android

Description The issue allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application, as Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card.

Recommendations For versions prior to 28.0.1, update to version 28.0.1 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-1515

Affected Products

Firefox

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-1515 · Security Note
• https://mozilla.org/security/announce/2014/mfsa2014-33.html · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=945429 · Note