CVE-2015-7211

EPSS 0.68%
Published 16.12.2015 11:59:09
Last modified 12.04.2025 10:46:40
Source security@mozilla.org
Teams watchlist Login
Open Login

Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors.

Affected products Warnungen 0 Metrics 2 CWE 1 References 14

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version <= 42.0

Fedoraproject ≫ Fedora Version22

Fedoraproject ≫ Fedora Version23

Opensuse ≫ Leap Version42.1

Opensuse ≫ Opensuse Version13.1

Opensuse ≫ Opensuse Version13.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.68%	0.706

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://security.gentoo.org/glsa/201512-10

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html

http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html

http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html

http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html

http://www.securitytracker.com/id/1034426

http://www.ubuntu.com/usn/USN-2833-1

http://www.securityfocus.com/bid/79280

http://www.mozilla.org/security/announce/2015/mfsa2015-141.html

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=1221444

https://nvd.nist.gov/vuln/detail/CVE-2015-7211

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-7211

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-7211

EUVD