Medium severity · published Jan 9, 2016
CVE-2015-8512
The lockscreen feature in Mozilla Firefox OS before 2.5 does not properly restrict failed authentication attempts, which makes it easier for physically proximate attackers to…
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
The lockscreen feature in Mozilla Firefox OS before 2.5 does not properly restrict failed authentication attempts, which makes it easier for physically proximate attackers to obtain access by entering many passcode guesses.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Firefox OS · Mozilla
through 2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8512
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8512
Vendor Advisory
http://www.mozilla.org/security/announce/2015/mfsa2015-151.html
bugzilla.mozilla.org
https://bugzilla.mozilla.org/show_bug.cgi?id=1181571
More from Firefox OS
8.8
CVE-2015-4495
Mozilla Firefox Security Feature Bypass Vulnerability
6.4
CVE-2015-8511
Race condition in the lockscreen feature in Mozilla Firefox OS before 2.5 allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors
6.1
CVE-2015-8510
Cross-site scripting (XSS) vulnerability in the internationalization feature in the default homescreen app in Mozilla Firefox OS before 2.5 allows user-assisted remote attackers…
3.7
CVE-2015-4000
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows…
–
CVE-2015-4489
The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory…