CVE-2015-4503

{"id": "CVE-2015-4503", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-09-24T04:59:06.160", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html", "source": "security@mozilla.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html", "source": "security@mozilla.org"}, {"url": "http://www.mozilla.org/security/announce/2015/mfsa2015-97.html", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html", "source": "security@mozilla.org"}, {"url": "http://www.securityfocus.com/bid/76815", "source": "security@mozilla.org"}, {"url": "http://www.securitytracker.com/id/1033640", "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=994337", "source": "security@mozilla.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application."}, {"lang": "es", "value": "Vulnerabilidad en la implementaci\u00f3n de la API TCP Socket en Mozilla Firefox en versiones anteriores a 41.0, no maneja correctamente los l\u00edmites del array que fueron establecidos con una llamada al m\u00e9todo navigator.mozTCPSocket.open y env\u00edo de llamadas a m\u00e9todos, lo que permite a servidores TCP remotos obtener informaci\u00f3n sensible de la memoria de proceso mediante la lectura de datos de paquete, seg\u00fan lo demuostrado por la disponiblidad de esta API en una aplicaci\u00f3n Firefox OS."}], "lastModified": "2016-12-22T02:59:55.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EE7B0EF-4A3A-4353-8B50-6F28B5CADBDB", "versionEndIncluding": "40.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}