Lucene search

K
mozillaMozilla FoundationMFSA2014-06
HistoryFeb 04, 2014 - 12:00 a.m.

Profile path leaks to Android system log — Mozilla

2014-02-0400:00:00
Mozilla Foundation
www.mozilla.org
37

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

0.002

Percentile

60.7%

Mozilla developer Roee Hay reported that Firefox for Android profile paths leak to the Android system log. When running on Android 4.2 or earlier, other applications are able to read these log files, leading to information disclosure from the user’s profile directory. This issue was also independently reported by Mozilla developer Richard Newman.

Affected configurations

Vulners
Node
mozillafirefoxRange<27
VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

0.002

Percentile

60.7%