Published: 05/08/2016 Updated: 16/08/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 4.3 | Impact Score: 1.4 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Mozilla Firefox prior to 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote malicious users to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Mozilla Foundation Security Advisory 2016-83 Spoofing attack through text injection into internal error pages Announced August 2, 2016 Reporter musicDespiteEverything Impact Low Products Firefox Fixed in ...

Mozilla Firefox before 480 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring ...

CWE-254 http://www.mozilla.org/security/announce/2016/mfsa2016-83.html https://bugzilla.mozilla.org/show_bug.cgi?id=1253673 http://www.securityfocus.com/bid/92260 http://www.ubuntu.com/usn/USN-3044-1 http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html https://security.gentoo.org/glsa/201701-15 http://www.securitytracker.com/id/1036508 https://usn.ubuntu.com/3044-1/https://nvd.nist.gov

CVE-2016-5268

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect