Lucene search

Mozilla FoundationMFSA2015-97

HistorySep 22, 2015 - 12:00 a.m.

Memory leak in mozTCPSocket to servers — Mozilla

2015-09-2200:00:00

Mozilla Foundation

www.mozilla.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

0.003

Percentile

71.8%

JSON

Security researcher David Chan reported that Mozilla’s mozTCPSocket implementation could leak data past the end of an array, allowing for the potential exposure of memory or private data to malicious servers.

Affected configurations

Vulners

Node

mozillafirefoxRange<41

mozillaseamonkeyRange<2.38

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillaseamonkey*cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	seamonkey	*	cpe:2.3:a:mozilla:seamonkey::::::::

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4503

bugzilla.mozilla.org/show_bug.cgi?id=994337

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

0.003

Percentile

71.8%

JSON

Related for MFSA2015-97