VulnerabilityModified
CVE-2015-7208
Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
MEDIUM 5.0EPSS 2.39%
Does this matter?
Lower severity and a low EPSS score (2.39%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.39% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- mozilla/firefox · fedoraproject/fedora · opensuse/leap · opensuse/opensuse
- Source
- security@mozilla.org
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-137.htmlVendor Advisory
- http://www.mozilla.org/security/announce/2016/mfsa2016-04.htmlVendor Advisory
- http://www.securityfocus.com/bid/79280
- http://www.securitytracker.com/id/1034426
- http://www.securitytracker.com/id/1034825
- http://www.ubuntu.com/usn/USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1191423
- https://security.gentoo.org/glsa/201512-10
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-137.htmlVendor Advisory
- http://www.mozilla.org/security/announce/2016/mfsa2016-04.htmlVendor Advisory
- http://www.securityfocus.com/bid/79280
- http://www.securitytracker.com/id/1034426
- http://www.securitytracker.com/id/1034825
- http://www.ubuntu.com/usn/USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1191423
- https://security.gentoo.org/glsa/201512-10
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.