CVE-2014-1566
Mozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the SD card during processing of file: URLs, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application.
Does this matter?
Lower severity and a low EPSS score (1.18%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the SD card during processing of file: URLs, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1515.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 1.18% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- mozilla/firefox
- Source
- security@mozilla.org
References
- http://www.mozilla.org/security/announce/2014/mfsa2014-71.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/69522
- http://www.securitytracker.com/id/1030792
- https://bugzilla.mozilla.org/show_bug.cgi?id=1050690
- https://security.gentoo.org/glsa/201504-01
- http://www.mozilla.org/security/announce/2014/mfsa2014-71.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/69522
- http://www.securitytracker.com/id/1030792
- https://bugzilla.mozilla.org/show_bug.cgi?id=1050690
- https://security.gentoo.org/glsa/201504-01
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.