PT-2015-4884 · Mozilla · Firefox

Bagder + 1 · Published 2015-04-01 · Updated 2024-12-12 · CVE-2015-0800

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox (aka Fennec) versions prior to 37.0 on Android

Description The issue is related to the PRNG implementation in the DNS resolver, which does not generate random numbers correctly for query ID values and UDP source ports. This makes it easier for remote attackers to spoof DNS responses by guessing these numbers.

Recommendations For Mozilla Firefox (aka Fennec) versions prior to 37.0 on Android, update to version 37.0 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-0800

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

Affected Products

Firefox

References · 2062

• https://nvd.nist.gov/vuln/detail/CVE-2015-0800 · Security Note
• http://mozilla.org/security/announce/2015/mfsa2015-41.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2009-0354 · Note
• https://suse.com/security/cve/CVE-2024-3302 · Note
• https://suse.com/security/cve/CVE-2024-1551 · Note
• https://suse.com/security/cve/CVE-2012-1937 · Note
• https://suse.com/security/cve/CVE-2023-25731 · Note
• https://suse.com/security/cve/CVE-2009-1307 · Note
• https://suse.com/security/cve/CVE-2020-6812 · Note
• https://suse.com/security/cve/CVE-2024-4769 · Note
• https://suse.com/security/cve/CVE-2016-5282 · Note
• https://suse.com/security/cve/CVE-2010-1210 · Note
• https://suse.com/security/cve/CVE-2009-3381 · Note