Bug 950686 (CVE-2015-7184) - VUL-0: CVE-2015-7184: Firefox 41.0.2 out of band release
Summary: VUL-0: CVE-2015-7184: Firefox 41.0.2 out of band release
Status: RESOLVED FIXED
Alias: CVE-2015-7184
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.2
: P5 - None : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-10-16 05:24 UTC by Wolfgang Rosenauer
Modified: 2020-04-05 18:19 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Rosenauer 2015-10-16 05:24:37 UTC 
Firefox update upcoming to 41.0.2 containing an out of band security fix.

MFSA 2015-115/CVE-2015-7184 (bmo#1208339, bmo#1212669)
Cross-origin restriction bypass using Fetch
Comment 1 Andreas Stieger 2015-10-16 06:37:29 UTC 
public at https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/

Cross-origin restriction bypass using Fetch

Announced
    October 15, 2015
Reporter
    Abdulrahman Alqabandi
Impact
    High
Products
    Firefox
Fixed in

        Firefox 41.0.2

Description

Security researcher Abdulrahman Alqabandi reported that the fetch() API did not correctly implement the Cross-Origin Resource Sharing (CORS) specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue.
Comment 2 Andreas Stieger 2015-10-16 08:41:22 UTC 
I read from the announcement that this does affect the ESR, so it's an openSUSE issue only.
Comment 4 Bernhard Wiedemann 2015-10-16 13:00:28 UTC 
This is an autogenerated message for OBS integration:
This bug (950686) was mentioned in
https://build.opensuse.org/request/show/339287 Factory / MozillaFirefox
https://build.opensuse.org/request/show/339288 Leap:42.1 / MozillaFirefox
https://build.opensuse.org/request/show/339289 13.2 / MozillaFirefox
https://build.opensuse.org/request/show/339290 13.1 / MozillaFirefox
Comment 5 Andreas Stieger 2015-10-23 23:50:00 UTC 
Releasing for 13.1 and 13.2
Comment 6 Swamp Workflow Management 2015-10-24 00:10:22 UTC 
openSUSE-SU-2015:1817-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 949983,950686
CVE References: CVE-2015-7184
Sources used:
openSUSE 13.2 (src):    MozillaFirefox-41.0.2-47.1
openSUSE 13.1 (src):    MozillaFirefox-41.0.2-91.1