Changes

==Severity Ratings =={| class="wikitable collapsible" style="width: 100%"! Severity Ratings & Examples|-|The following items are keywords for the severity of an issue. ;'''sec-critical''': Exploitable vulnerabilities which can lead to the widespread compromise of many users requiring no more than normal browsing actions. This includes both "full chains" with a content process remote code execution combined with a sandbox escape, as well as sandbox bypasses where remote code execution is achieved directly in an unsandboxed process.{| class="wikitable collapsible " style="width: 100%"! ''sec-critical Examples:''|-|* Overflows resulting in native code execution * JavaScript injection into browser chrome* Launching of arbitrary local application with provided arguments* Filetype spoofing where executables can masquerade as benign content types* Installation & execution of plugins/modules with chrome/native privileges, without user consent or via user dialog fatigue* The severity of web application bugs can depend on the value of the data that could be compromised. Flaws that could be considered critical include** XSS (Stored)** CSRF** Code Injection** Authentication Flaws (which lead to account compromise)** Session Management Flaws (which lead to account compromise) |} ;'''sec-high'''[https: Obtain confidential data from other sites the user is visiting or the local machine (including the user's IP address if a proxy is used), or inject data or code into those sites, requiring no more than normal browsing actions. Indefinite DoS of the user's system, requiring OS reinstallation or extensive cleanup. Exploitable web vulnerabilities that can lead to the targeted compromise of a small number of users. Sandbox escapes which require the attacker to already have arbitrary code execution in the content process.{| class="wikitable collapsible " style="width: 100%"! ''sec-high Examples:''|-|* Cross-site Scripting (XSS)* Theft of arbitrary files from local system* Spoofing of full URL bar or bypass of SSL integrity checks* Memory read that results in data being written into an inert container (ie string or image) that is subsequently accessible to content* XSS (Reflected)* Failure to use TLS where needed to ensure confidential/security * Memory corruption in a parent process IPC method which a malicious content process could exploit.* Proxy bypass|} ;'''sec-moderate''': Vulnerabilities which can provide an attacker additional information or positioning that could be used in combination with other vulnerabilities. Disclosure of sensitive information that represents a violation of privacy but by itself does not expose the user or organization to immediate risk. The vulnerability combined with another moderate vulnerability could result in an attack of high or critical severity (aka stepping stone). Indefinite application Denial of Service (DoS) via corruption of state, requiring application re-installation or temporary DoS of the user's system, requiring reboot. The lack of standard defense in depth techniques and security controls. Client bugs that might have high or critical results but require the user perform unusual or complex actions to trigger.{| class="wikitable collapsible " style="width: 100%"! ''sec-moderate Examples:''|-|* Disclosure of OS username* Disclosure of browser cache salt* Disclosure of entire browsing history* Detection of arbitrary local files* Launching of arbitrary local application without arguments* Local storage of passwords in unencrypted form* Persistent DoS attacks that prevent the user from starting Firefox or another application in the future* Missing Additional Security Controls (x-frame options, SECURE/HTTPOnly flags, etc)* Error Handling Issues |};'''sec-low''': Minor security vulnerabilities such as leaks or spoofs of non-sensitive informationwiki. Missing best practice security controls  {| class="wikitable collapsible " style="width: 100%"! ''sec-low Examples:''|-|* Detection of previous visit to a specific site* Identification of users by profiling browsing behavior.* Corruption of chrome dialogs or user input without the ability to spoof arbitrary messages* Lack of proper input validation (not resulting in XSS or injection)* Content spoofing (non-html) |};'''sec-other''': Bugs that may not be exploitable security issues but are kept confidential to protect sensitive information. Bugs that contain sensitive information about the bug submitter or another user Bugs that are related to security issues currently unfixed in Mozilla products or other products {| class="wikitable collapsible " style="width: 100%"! ''sec-other Examples:''|-|* Bypassing kiosk mode* Flaws we need to track that are not in our code base|};'''Mitigating Circumstances''':If there are mitigating circumstances that severely reduce the effectiveness of the exploit, then the exploit could be reduced by one level of severity. Examples of mitigating circumstances include difficulty in reproducing due to very specific timing or load order requirements, complex or unusual set of actions the user would have to take beyond normal browsing behaviors, or unusual software configuration.  As a rough guide, to be considered for reduction in severity an exploit should execute successfully less than 10% of the time. If measures can be taken to improve the reliability of the exploit to over 10% (by combining it with other existing bugs or techniques), then it should not be considered to be mitigated.|} ==Additional Status Codes, Whiteboard Tracking Tags & Flags==If a potential security issue has not yet been assigned a severity rating, or a rating is not appropriate, the whiteboard may instead contain one of the following security status codes. === Shared Keywords ==={| style="width: 800px;" class="wikitable collapsible fullwidth-table"! Shared Keywords|-! style="width:5%" | Code ! style="width:10%"| Description! style="width:5%" | Examples|-|<b>sec-audit</b>|Bug requires a code audit to investigate potential security problemsmozilla. DO NOT USE for an actual vulnerability; if a bug has or might have a sec-loworg/sec-moderate/sec-high/sec-critical rating then it is not a sec-audit bug. Such a vulnerability might spawn a separate sec-audit bug as a task item to scan for the same pattern elsewhere in the code.|Look for pattern x in library yAudit file z for string buffer abuse.|-|<b>sec-vector</b>|Flaws not in Mozilla controlled software, but can cause security problems for Mozilla users.|Bugs in pluginsBugs in system libraries used by Firefox|-|<b>sec-want</b>|New features or improvement ideas related to security|User interface refinements Support for new types of authentication  Code refactoring / cleanup|-|<b>sec-incident</b>| Issues resulting in an incident response or 'chemspill' actions by the security team.| Server compromiseCode issues that would cause client code to be respun.|-|} === Group Keywords ==={| style="width: 800px;" class="wikitable collapsible fullwidth-table"! Group Keywords|-! style="width:5%" | Code ! style="width:10%"| Description! style="width:5%" | Examples|-| <b>csectype- </b>| Client Security (ie. Firefox, Thunderbird, etc)| {|class="wikitable collapsible fullwidth-table"! csectype-|-! style="width:5%" | Code ! style="width:10%"| Description|-|csectype-bounds || client security issues due to incorrect boundary conditions (read or write)|-|csectype-disclosure || Disclosure of sensitive user data, personal information, etc in a client product. |-|csectype-dos || Used to tag client Denial of Service bugs. For web server denial of service bugs please use wsec-dos as these tend to be more severe. Search 28|-|csectype-intoverflow || client security issues due to integer overflow |-|csectype-oom || A client crash or hang that occurs in Out Of Memory conditions Search 2|-|csectype-other || client security issues that don't fit into other categories |-|csectype-priv-escalation || client privilege escalation security issues |-|csectype-sop || violations of the client Same Origin Policy (Universal-XSS bugs, for example). |-|csectype-uaf || client security issues due to a use-after-free Search 1|-|csectype-ui-redress || client security issues due to UI Redress attacks, either site-on-site ("clickjacking" and friends) or manipulation of the browser UI to fool users into taking the wrong action. |-|csectype-undefined || Bugs--or potential bugs--due to undefined compiler behavior.|-|csectype-uninitialized || client security issues due to use of uninitialized memory |-|csectype-wildptr || client security issues due to pointer misuse not otherwise covered (see csectype-uaf, csectype-uninitialized, csectype-intoverflow, csectype-bounds)|-|}|-| <b>wsec- <Security_Severity_Ratings/b>| Web Security (Web Sites, Web Services, etc)|{|class="wikitable collapsible fullwidth-table"! wsec-|-! style="width:5%" | Code ! style="width:10%"| Description|-|wsec-authentication || Website or server authentication security issues (lockouts, password policy, etc)|-|wsec-authorization || web/server authorization security issues|-|wsec-cookie || Cookie related errors (HTTPOnly / Secure Flag, incorrect domain / path)|-|wsec-crossdomain || Issue such as x-frame-options, crossdomain.xml, cross site sharing settings|-|wsec-crypto || Crypto related items such as password hashing|-|wsec-csrf || Cross-Site Request Forgery (CSRF) bugs in server products|-|wsec-disclosure || Disclosure of sensitive data, personal information, etc from a web service|-|wsec-dos || Used to denote web server Denial of Service bugs. For similar bugs in client software please use csectype-dos instead.|-|wsec-errorhandling || Any error handling issue|-|wsec-impersonation || Impersonation / Spoofing attacks (UI Redress, etc) |-|wsec-injection || Injection attacks other than SQLi or XSS |-|wsec-input || Failure to perform input validation. Most often you will probably use the xss tag instead|-|wsec-logging || Logging issues such as requests for CEF log points.|-|wsec-other || web/server security issues that don't fit into other categories|-|wsec-session || Issues related to sesson management (Session fixation, etc)|-|wsec-sqli || SQL Injection |-|wsec-ssrf || Server Side Request Forgery (SSRF) bugs in server products. CWE-918|-|wsec-xss || Cross-Site Scripting (XSS) bugs in server products|-|}|-| <b>opsec- </b>| Operations Security (Mozilla owned & operated severs and services)|{|class="wikitable collapsible fullwidth-table"! opsec-|-! style="width:5%" | Code ! style="width:10%"| Description|-| opsec-access| The identified issue is an access violation.|-|}|} === Whiteboard Tags ==={| style="width: 800px;" class="wikitable collapsible fullwidth-table"! Whiteboard Tags|-! style="width:5%" | Code ! style="width:10%"| Description! style="width:5%" | Examples|-|<strike><b>sec-assigned:UserAlias</b></strike> <b>depricated for sec-review? flag with alias</b>|This designates the assigned security resource that is accountable for actions to be taken on the designated item. When possible the bug will be assigned to the security contact for action. This will be used when that is not possible or practical.|sec-review?:curtisk@blah.bah indicates that curtisk is the accountable party for action|-|<b>[Q2Severity Ratings]</b>|This designates a bug as being identified as a request to be done or targeted for a given operational quarter. If no year is given it is for the current year.|[Q2] indicates second quarter of the current calendar year, [Q1-2013] would be used to indicate a target for an upcoming quarter that has not occurred. |-|<b>[k90]</b>|This designates a bug as being part of the Kilimanjaro effort so that it can be tracked, triaged and given appropriate priority and attention.||-|<b>[basecamp]</b>|This designates a bug as being part of the basecamp sub effort of the Kilimanjaro effort.||- |<b>[fennec]</b>|This designates a bug as being a critical bug for the efforts around our mobile browser project. This could be combined with either the [k9o] or [basecamp] tags as a bug could be part of both.||-|<b>[triage needed]</b>|Used to mark a bug for weekly triage meeting.||-|<strike><b>[pending secreview]</b></strike> deprecated| Indicates a secreview or tasks related to said review are yet to be completed.||-|<b>[start mm/dd/yyyy][target mm/dd/yyyy]</b>|This indicates that expected dates to start and complete work on a given review or security bug.|[start 01/29/2013][target 02/09/2013] indicates work will start on 29-Jan and expected target for completion on 09-Feb|-|<strike><b>* [completed secreview]</b></strike> deprecated| Indicates the given secreview or related tasks have been completed||-|<b>mentorship</b>| Indicates that a given bug is part of our security mentorship program. The assignee of said bug is the Mozilla mentor for such a bug.||-|<strike><b>[score:##]</b></strike> deprecated|This indicates the relative severity score for risk rating bugs per the calculator at https://peoplewiki.mozilla.com/~ckoenig/|[score:30:moderate] shows that the issue has a numerical score of 30 and a severity of moderate.|-|<b>[FX]</b>|Indicates an item related to Firefox||-|<b>[FXOS]</b>|Indicates an item related to Firefox OS||-|<b>[Web]</b>|Indicates an item related to our Web properties||-|<b>u= c= p=</b>|These items are used to allow bugs to be tracked by scrumbu.gs for work tracking ([http://scrumbu.gs/help/ more info]).||-|<b>s=</b>|This tag is used in conjunction with the scrumbu.gs tags above to indicate which sprint a given bug has been assigned.|s=13q4.1 indicates the bug is in the year 2013, 4th quarter and sprint 1. Each sprint is 2 weeks long and it's calendar dates can be tracked on scrumbu.gs|-|} === Feature Page Codes ==={| style="width: 800px;" class="wikitable collapsible fullwidth-table"! Feature Page Codes|-! style="width:5%" | Code ! style="width:10%"| Description! style="width:5%" | Examples|-|<b>sec-review-needed</b>|A security review is needed for the feature, this could mean a variety of things. If there is no <username> in the notes then a full review needs to be scheduled, if a <username> is present than that person will follow-up with the feature team on whatever task is needed.||-|<b>sec-review-complete</b>|The security review / actions desired have been completed. This will result in a link to the notes from security actions or a note from the assigned resource.||-|<b>sec-review-active</b>| There are active tasks associated with the review that are yet to be completed in order for the review to be seen as completed. These will be captured in the "Action Items" section of the review notes.||-|<b>sec-review-sched</b>| Security review tasks have been scheduled, if this is a full security review the date of the scheduled review will be present in the security notes.||-|<b>sec-review-unnecessary</b>| After triage it was felt the feature needed no review or security actions. ||-| <b>Security health: <blank></b>| There are no notes or status is unknown.| Color: <None>|-| <b>Security health: OK</b>| The tasks are on schedule or completed and are considered non-blocking.| {{StatusHealthy|status=Color: Green}}|-| <b>Security health: Blocked</b>| Some aspect of the security review has given cause to block the feature from further work or landing. The reasons will be listed in the security notes or linked to a larger review outcome for follow-up.| {{StatusBlocked|status=Color: Yellow}}|-| <b>Security health: At Risk</b>| Some aspect of the security review may cause the feature to be blocked or put the feature at risk of being off schedule.The reasons will be listed in the security notes or linked to a larger review outcome for follow-up.| {{StatusAtRisk|status=Color: Red}}|-| <b>Security health: Assigned</b>| Security tasks have been assigned to a member of the team to followup. The name of this resource will be in the security notes.| {{StatusAssigned|status=Color: Teal}}|-|}=== Flags ==={| style="width: 800px;" class="wikitable collapsible fullwidth-table"! Flags|-! style="width:5%" | Flag ! style="width:10%"| Description! style="width:5%" | Settings|-| sec-review| Security review - Requesting action from the security assurance team or showing the results of said action| {|class="wikitable fullwidth-table"|-! style="width:5%" | Setting ! style="width:10%"| Description|-|'?'|| Request for the security team to review the requested bug for action|-|'+'|| Bug has been reviewed, actions are done and the security team has no further concerns at this time|-|'-'|| But has been reviewed and found to be deficient in a security metric that should be mitigated|-|}|-| sec-bounty| Shows the status of a bug with regards to a bounty payout per our bounty guidlines|{|class="wikitable fullwidth-table"|-! style="width:5%" | Setting ! style="width:10%"| Description|-|'?'|| Bug is nominated for review by the bounty committee|-|'+'|| Bug has been accepted and a payment will be made|-|'-'|| Bug does not meet criteria and a payment will ''not'' be made|-|}|} [[org/Security_Severity_Ratings/archive | archive]Client Client Severity Ratings]