PRIOn knowledge basePRION:CVE-2014-1595Design/Logic Flaw
5.5 Medium
AI Score
Confidence
Low
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
5.4%
Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by jemalloc-based applications, which allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information.
| CPE | Name | Operator | Version |
|---|---|---|---|
| firefox | le | 33.0 | |
| firefox_esr | eq | 31.0 | |
| firefox_esr | eq | 31.1.0 | |
| firefox_esr | eq | 31.1.1 | |
| firefox_esr | eq | 31.2 | |
| thunderbird | le | 31.2 |
References
lists.apple.com/archives/security-announce/2015/Jan/msg00003.html
support.apple.com/HT204244
www.mozilla.org/security/announce/2014/mfsa2014-90.html
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
www.reddit.com/r/netsec/comments/2ocxac/apple_coregraphics_framework_on_os_x_1010_is/
bugzilla.mozilla.org/show_bug.cgi?id=1092855
Related
5.5 Medium
AI Score
Confidence
Low
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
5.4%