Vulnerability in Apple Mac OS X
CVE-2014-1595
Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by jemalloc-based applications, which allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information.
EPSS: 0.003 (23.1th percentile) — read the EPSS interpretation.
Affected products
- Apple Mac_os_x — versions 10.10.0
- Mozilla Firefox — versions 31.0, 31.1.0, 31.1.1
- Mozilla Firefox_esr — versions 31.2
- Mozilla Thunderbird
- N/a — versions n/a
Weakness classification (CWE)
References
- security@mozilla.org (x_refsource_CONFIRM)
- security@mozilla.org (x_refsource_CONFIRM)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (x_refsource_CONFIRM)
- security@mozilla.org (x_refsource_MISC)
- security@mozilla.org (vendor-advisory, x_refsource_APPLE)