oss-sec mailing list archives
Re: CVE request for BZ
From: David Lawrence <dkl () mozilla com>
Date: Fri, 23 Jan 2015 16:38:53 -0500
Sorry not explicit in the sec adv but you are correct. No exploit has been reported regarding the webservices changes and was just to prevent such problems in the future. The methods that were unintentionaly accessible were all relatively harmless. We added the safeguard in case other modules were imported in the future which could possibly give out sensitive data unintentionally. Thanks dkl On 01/23/2015 04:29 PM, Kurt Seifried wrote:
http://www.bugzilla.org/security/4.0.15/ one has a CVE, and this one does not: Class: Information Leak Versions: 2.23.3 to 4.0.15, 4.1.1 to 4.2.11, 4.3.1 to 4.4.6, 4.5.1 to 4.5.6 Fixed In: 4.0.16, 4.2.12, 4.4.7, 5.0rc1 Description: Using the WebServices API, a user can possibly execute imported functions from other non-WebService modules. A whitelist has now been added that lists explicit methods that can be executed via the API. References: https://bugzilla.mozilla.org/show_bug.cgi?id=1090275 was this classed as hardening hence no CVE? E.g. has no exploit been found, or?
-- David Lawrence dkl () mozilla com bugzilla.mozilla.org
Current thread:
- CVE request for BZ Kurt Seifried (Jan 23)
- Re: CVE request for BZ David Lawrence (Jan 23)