CVEvulnerability
CVE-2015-7195
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-11-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers, which allows remote attackers to obtain sensitive information via vectors involving a redirect.
Affected configurations
• mozilla firefox (<= 41.0.2)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-129.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securitytracker.com/id/1034069 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2785-1 www.ubuntu.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1211871 bugzilla.mozilla.org
- https://security.gentoo.org/glsa/201512-10 security.gentoo.org
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-129.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securitytracker.com/id/1034069 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2785-1 www.ubuntu.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1211871 bugzilla.mozilla.org
- https://security.gentoo.org/glsa/201512-10 security.gentoo.org