PT-2015-4884

CVE-2015-0800

Published

2015-04-01

Updated

2024-12-12

Description by

CVSS 2.0

5.0

Medium

MetricsAV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox (aka Fennec) versions prior to 37.0 on Android

Description The issue is related to the PRNG implementation in the DNS resolver, which does not generate random numbers correctly for query ID values and UDP source ports. This makes it easier for remote attackers to spoof DNS responses by guessing these numbers.

Recommendations For Mozilla Firefox (aka Fennec) versions prior to 37.0 on Android, update to version 37.0 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2015-0800

OPENSUSE-SU-2024:10071-1