CVEvulnerability
CVE-2015-4503
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-09-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.
Affected configurations
• mozilla firefox (<= 40.0.3)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-97.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securityfocus.com/bid/76815 www.securityfocus.com
- http://www.securitytracker.com/id/1033640 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=994337 bugzilla.mozilla.org
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-97.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securityfocus.com/bid/76815 www.securityfocus.com
- http://www.securitytracker.com/id/1033640 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=994337 bugzilla.mozilla.org