Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2014-90

Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory

Announced
December 2, 2014
Reporter
Kent Howard
Impact
High
Products
Firefox, Firefox ESR, Thunderbird
Fixed in
  • Firefox 34
  • Firefox ESR 31.3
  • Thunderbird 31.3

Description

Security researcher Kent Howard reported an Apple issue present in OS X 10.10 (Yosemite) where log files are created by the CoreGraphics framework of OS X in the /tmp local directory. These log files contain a record of all inputs into Mozilla programs during their operation. In versions of OS X from versions 10.6 through 10.9, the CoreGraphics had this logging ability but it was turned off by default. In OS X 10.10, this logging was turned on by default for some applications that use a custom memory allocator, such as jemalloc, because of an initialization bug in the framework. This issue has been addressed in Mozilla products by explicitly turning off the framework's logging of input events. On vulnerable systems, this issue can result in private data such as usernames, passwords, and other inputed data being saved to a log file on the local system.

This issue does not affect OS X users prior to 10.10. Users on OS X 10.10 should go to their /tmp folder and delete any files with names beginning with "CGLog_" followed by the name of a Mozilla product, such as "CGLog_firefox".

References