Bug 1236950 – CVE-2015-2727 Mozilla: Local files or privileged URLs in pages can be opened into new tabs (MFSA 2015-60)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1236950 - (CVE-2015-2727) CVE-2015-2727 Mozilla: Local files or privileged URLs in pages can be opened into new tabs (MFSA 2015-60)

Summary:	CVE-2015-2727 Mozilla: Local files or privileged URLs in pages can be opened ...

Status:	CLOSED ERRATA

Aliases:	CVE-2015-2727

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20150702,repor...
Keywords:	Security

Depends On:
Blocks:	1235754
	Show dependency tree / graph

Reported:	2015-06-30 00:56 EDT by Huzaifa S. Sidhpurwala
Modified:	2015-11-24 07:22 EST (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-07-06 00:26:50 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:1207	normal	SHIPPED_LIVE	Critical: firefox security update	2015-07-03 05:12:10 EDT

Groups: None (edit)

Description Huzaifa S. Sidhpurwala 2015-06-30 00:56:26 EDT

Security researcher Jann Horn reported that when Mozilla Foundation Security Advisory 2015-25 was fixed in Firefox 37, an error was made that caused the fix to not be applied to Firefox 38, effectively causing the bug to be unfixed in Firefox 38 (and Firefox ESR38) once it shipped. As Armin Razmdjou reported for that issue, opening hyperlinks on a page with the mouse and specific keyboard key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. This could allow for local files or resources from a known location to be opened with local privileges, bypassing security protections. 


External Reference:

http://www.mozilla.org/security/announce/2015/mfsa2015-60.html


Acknowledgements:

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Jann Horn as the original reporter.

Comment 1 errata-xmlrpc 2015-07-03 01:13:18 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2015:1207 https://rhn.redhat.com/errata/RHSA-2015-1207.html

Comment 2 Huzaifa S. Sidhpurwala 2015-07-06 00:26:50 EDT

Statement:

This issue does not affect the version of thunderbird package, as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Note You need to log in before you can comment on or make changes to this bug.