The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade linux-firefoxUpgrade firefoxUpgrade thunderbirdUpgrade seamonkeyUpgrade libxulUpgrade linux-seamonkeyUpgrade firefox-esrUpgrade linux-thunderbird | Dec 10, 2025 | Sep 22, 2015 |
| Mfsa2015 97 | — | Upgrade to Mozilla Firefox version 41.0Upgrade to the latest version of Mozilla Firefox | Sep 23, 2015 | Sep 22, 2015 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.38.0 | Oct 22, 2015 | Sep 24, 2015 |
| Oracle Solaris | — | Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Sep 24, 2015 |
| Suse | — | Upgrade MozillaFirefoxUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-other | Dec 18, 2015 | Sep 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub