[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2016-1965Date: (C)2016-04-28   (M)2024-03-27


Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 4.3CVSS Score : 4.3
Exploit Score: 2.8Exploit Score: 8.6
Impact Score: 1.4Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector: NETWORK
Attack Complexity: LOWAccess Complexity: MEDIUM
Privileges Required: NONEAuthentication: NONE
User Interaction: REQUIREDConfidentiality: NONE
Scope: UNCHANGEDIntegrity: PARTIAL
Confidentiality: NONEAvailability: NONE
Integrity: LOW 
Availability: NONE 
  
Reference:
SECTRACK-1035215
DSA-3510
GLSA-201605-06
SUSE-SU-2016:0727
SUSE-SU-2016:0777
SUSE-SU-2016:0820
SUSE-SU-2016:0909
USN-2917-1
USN-2917-2
USN-2917-3
http://www.mozilla.org/security/announce/2016/mfsa2016-28.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
https://bugzilla.mozilla.org/show_bug.cgi?id=1245264
openSUSE-SU-2016:0731
openSUSE-SU-2016:0733
openSUSE-SU-2016:0876
openSUSE-SU-2016:0894

CPE    17
cpe:/o:opensuse:opensuse:13.1
cpe:/a:mozilla:firefox_esr:38.0
cpe:/o:oracle:linux:6.0
cpe:/o:oracle:linux:7.0
...
CWE    1
CWE-254
OVAL    16
oval:org.secpod.oval:def:33494
oval:org.secpod.oval:def:33520
oval:org.secpod.oval:def:602413
oval:org.secpod.oval:def:1501393
...

© SecPod Technologies