CVE-2015-7195 Information

Description

The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers which allows remote attackers to obtain sensitive information via vectors involving a redirect.

Reference

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html http://www.mozilla.org/security/announce/2015/mfsa2015-129.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securitytracker.com/id/1034069 http://www.ubuntu.com/usn/USN-2785-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1211871 https://security.gentoo.org/glsa/201512-10