Unscored severity · published Mar 19, 2014
CVE-2014-1507
Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify arbitrary files, via a crafted application that uses a relative pathname for a DeviceStorageFile object.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firefoxos · Mozilla
through 1.2 · source: NVD
SO
Solaris · Oracle
11.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1507
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1507
Vendor Advisory
http://www.mozilla.org/security/announce/2014/mfsa2014-25.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=940684