Lucene search

Mozilla FoundationMFSA2013-25

HistoryFeb 19, 2013 - 12:00 a.m.

Privacy leak in JavaScript Workers — Mozilla

2013-02-1900:00:00

Mozilla Foundation

www.mozilla.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

74.7%

JSON

Mozilla security researcher Frederik Braun discovered that since Firefox 15 the file system location of the active browser profile was available to JavaScript workers. While not dangerous by itself, this could potentially be combined with other vulnerabilities to target the profile in an attack.

Affected configurations

Vulners

Node

mozillafirefoxRange<19

mozillafirefox_esrRange<17.0.3

mozillaseamonkeyRange<2.16

mozillathunderbirdRange<17.0.3

mozillathunderbird_esrRange<17.0.3

CPENameOperatorVersion
firefoxlt19
firefox esrlt17.0.3
seamonkeylt2.16
thunderbirdlt17.0.3
thunderbird esrlt17.0.3

Name	Operator	Version
firefox	lt	19
firefox esr	lt	17.0.3
seamonkey	lt	2.16
thunderbird	lt	17.0.3
thunderbird esr	lt	17.0.3

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0774

bugzilla.mozilla.org/show_bug.cgi?id=827193

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

74.7%

JSON

Related for MFSA2013-25