PT-2015-1901 · Mozilla · Firefox Os

Paul Theriault + 1 · Published 2015-08-06 · Updated 2015-08-10 · CVE-2015-4494

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox OS versions prior to 2.2

Description The issue is related to the lack of protection for system messages in Firefox OS, allowing attackers to obtain potentially sensitive information via a crafted app. This could enable a remote attacker to access protected information contained in system messages.

Recommendations For Mozilla Firefox OS versions prior to 2.2, consider restricting access to system messages or disabling the ability to read these messages until a patch is available. As a temporary workaround, avoid using crafted apps that could exploit this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-11247

CVE-2015-4494

Affected Products

Firefox Os

References · 4

• http://mozilla.org/security/announce/2015/mfsa2015-76.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4494 · Security Note
• https://bdu.fstec.ru/vul/2015-11247 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1138808 · Note