CVE-2015-7195

Description

The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers, which allows remote attackers to obtain sensitive information via vectors involving a redirect.

References

https://security.gentoo.org/glsa/201512-10

https://bugzilla.mozilla.org/show_bug.cgi?id=1211871

http://www.ubuntu.com/usn/USN-2785-1

http://www.securitytracker.com/id/1034069

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.mozilla.org/security/announce/2015/mfsa2015-129.html

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3