CVE-2015-4503
published 2015-09-24CVE-2015-4503: The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method…
PriorityP424medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.56%
72.8th percentile
The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 40.0.3 | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wxv2-7x8x-wpcq: The TCP Socket API implementation in Mozilla Firefox before 41
ghsa_unreviewed·2022-05-17
CVE-2015-4503 [MEDIUM] CWE-200 GHSA-wxv2-7x8x-wpcq: The TCP Socket API implementation in Mozilla Firefox before 41
The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.
Red Hat
Mozilla: Memory leak in mozTCPSocket to servers (MFSA 2015-97)
vendor_redhat·2015-09-22·CVSS 5.0
CVE-2015-4503 [MEDIUM] CWE-200 Mozilla: Memory leak in mozTCPSocket to servers (MFSA 2015-97)
Mozilla: Memory leak in mozTCPSocket to servers (MFSA 2015-97)
The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 7) -
No detection rules found.
No public exploits indexed.
Bugzilla
[SECURITY] XSS in dependency graphs when displaying the bug summary
bugzilla·2015-11-04
[HIGH] [SECURITY] XSS in dependency graphs when displaying the bug summary
[SECURITY] XSS in dependency graphs when displaying the bug summary
During the generation of a dependency graph also the code for the html image map is generated if a local dot installation is used.
With html escaped characters in a bug summary it is possible to inject custom lines in the *.map file with which the CreateImagemap function generates html code without filtering.
poc:
- configure bugzilla to use a local dot installation to generate a dependency graph
- create a bug with the following summary:
default ">alert(1) G
- visit /showdependencygraph.cgi?id=&showsummary=on&display=tree&rankdir=TB, a javascript alert prompt will show up
Discussion:
Confirmed! Thanks for catching that.
---
Created attachment 8683094
patch for 5.0 and master, v1
The bug summary is escaped too late
Bugzilla
CVE-2015-4503 Mozilla: Memory leak in mozTCPSocket to servers (MFSA 2015-97)
bugzilla·2015-09-23·CVSS 5.0
CVE-2015-4503 [MEDIUM] CVE-2015-4503 Mozilla: Memory leak in mozTCPSocket to servers (MFSA 2015-97)
CVE-2015-4503 Mozilla: Memory leak in mozTCPSocket to servers (MFSA 2015-97)
Security researcher David Chan reported that Mozilla's mozTCPSocket
implementation could leak data past the end of an array allowing for the
potential exposure of memory or private data to malicious servers.
This feature is used by Firefox OS and is disabled by default in Firefox on
other operating systems.
Upstream bug:
https://bugzilla.mozilla.org/show_bug.cgi?id=994337
External References:
https://www.mozilla.org/en-US/security/advisories/mfsa2015-97/
Discussion:
Acknowledgements:
Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges David Chan as the original reporter.
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.htmlhttp://www.mozilla.org/security/announce/2015/mfsa2015-97.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securityfocus.com/bid/76815http://www.securitytracker.com/id/1033640https://bugzilla.mozilla.org/show_bug.cgi?id=994337http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.htmlhttp://www.mozilla.org/security/announce/2015/mfsa2015-97.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securityfocus.com/bid/76815http://www.securitytracker.com/id/1033640https://bugzilla.mozilla.org/show_bug.cgi?id=994337
2015-09-24
Published