Information disclosure in Mozilla Firefox

CVE-2015-4503

The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.

Vulnerability class: Information Disclosure

EPSS: 0.016 (72.7th percentile) — read the EPSS interpretation.

Affected products

Mozilla Firefox
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security@mozilla.org (vendor-advisory, x_refsource_SUSE)
security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
security@mozilla.org (x_refsource_CONFIRM)
security@mozilla.org (vdb-entry, x_refsource_BID)
security@mozilla.org (vdb-entry, x_refsource_SECTRACK)
security@mozilla.org (x_refsource_CONFIRM)
security@mozilla.org (vendor-advisory, x_refsource_SUSE)