Bug 1265603 (CVE-2015-4476)

Summary:	CVE-2015-4476 Mozilla: Site attribute spoofing on Android by pasting URL with unknown scheme (MFSA 2015-99)
Product:	[Other] Security Response	Reporter:	Prasad Pandit <ppandit>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cschalle, gecko-bugs-nobody, jhorak, stransky
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-09-23 20:19:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1261782

Description Prasad Pandit 2015-09-23 10:38:21 UTC

ecurity researcher Jordi Chancel reported that on Firefox for Android, when a
URL is pasted with an unknown protocol, such as secure: or httpz, the pasted
URL is shown in the addressbar but no navigation occurs. Other address bar
attributes present before this pasted URL is entered will continue to be
rendered. This could lead to potential spoofing by a malicious site.

This issue only affects Firefox for Android and does not affect Firefox on
OS X, Linux, or Windows operating systems.

Upstream bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=1162372

External References:

https://www.mozilla.org/en-US/security/advisories/mfsa2015-99/

Comment 1 Martin Prpič 2015-09-24 12:41:32 UTC

Acknowledgements:

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Jordi Chancel as the original reporter.