CVE-2014-1507 Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify arbitrary files, via....
HighCVSS 9.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify arbitrary files, via a crafted application that uses a relative pathname for a DeviceStorageFile object.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle solaris | = 11.3 | No fix listed |
| mozilla firefoxos | <= 1.2 | No fix listed |
References
- www.mozilla.org vendor-advisory
- www.oracle.com third-party-advisory
- bugzilla.mozilla.org issue-tracking