Vulnerability-Lookup

CERTFR-2016-AVI-259

Vulnerability from certfr_avis - Published: 2016-08-03 - Updated: 2016-08-03

De multiples vulnérabilités ont été corrigées dans Mozilla Firefox. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Mozilla	Firefox	Firefox ESR versions antérieures à 45.3
	Mozilla	Firefox	Firefox versions antérieures à 48

References

Title

Publication Time

Tags

Bulletin de sécurité Mozilla mfsa2016-74 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-73 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-62 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-67 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-75 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-72 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-81 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-68 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-84 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-78 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-63 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-76 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-77 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-65 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-71 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-82 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-64 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-83 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-69 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-80 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-70 du 02 août 2016	None	vendor-advisory
Bulletin de sécurité Mozilla mfsa2016-79 du 02 août 2016	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Firefox ESR versions ant\u00e9rieures \u00e0 45.3",
      "product": {
        "name": "Firefox",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Firefox versions ant\u00e9rieures \u00e0 48",
      "product": {
        "name": "Firefox",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2016-5255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5255"
    },
    {
      "name": "CVE-2016-5250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5250"
    },
    {
      "name": "CVE-2016-2837",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-2837"
    },
    {
      "name": "CVE-2016-5261",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5261"
    },
    {
      "name": "CVE-2016-2839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-2839"
    },
    {
      "name": "CVE-2016-5254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5254"
    },
    {
      "name": "CVE-2016-0718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0718"
    },
    {
      "name": "CVE-2016-5263",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5263"
    },
    {
      "name": "CVE-2016-5260",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5260"
    },
    {
      "name": "CVE-2016-5265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5265"
    },
    {
      "name": "CVE-2016-2838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-2838"
    },
    {
      "name": "CVE-2016-5264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5264"
    },
    {
      "name": "CVE-2016-5258",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5258"
    },
    {
      "name": "CVE-2016-5259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5259"
    },
    {
      "name": "CVE-2016-2836",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-2836"
    },
    {
      "name": "CVE-2016-5252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5252"
    },
    {
      "name": "CVE-2016-5267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5267"
    },
    {
      "name": "CVE-2016-5268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5268"
    },
    {
      "name": "CVE-2016-5262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5262"
    },
    {
      "name": "CVE-2016-2830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-2830"
    },
    {
      "name": "CVE-2016-5253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5253"
    },
    {
      "name": "CVE-2016-5266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-5266"
    }
  ],
  "initial_release_date": "2016-08-03T00:00:00",
  "last_revision_date": "2016-08-03T00:00:00",
  "links": [],
  "reference": "CERTFR-2016-AVI-259",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2016-08-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMozilla Firefox\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, un d\u00e9ni de service \u00e0 distance et un contournement de la\npolitique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Mozilla Firefox",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-74 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-73 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-62 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-67 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-75 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-72 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-81 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-68 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-84 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-78 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-63 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-76 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-77 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-65 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-71 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-82 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-64 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-83 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-69 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-80 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-70 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2016-79 du 02 ao\u00fbt 2016",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/"
    }
  ]
}

CVE-2016-5267 (GCVE-0-2016-5267)

Vulnerability from cvelistv5 – Published: 2016-08-05 01:00 – Updated: 2024-08-06 00:53

Summary

Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a right-to-left character set.

Severity

No CVSS data available.

CWE

Assigner

mozilla

References

5 references

URL	Tags
http://www.securitytracker.com/id/1036508	vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/92260	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201701-15	vendor-advisoryx_refsource_GENTOO
http://www.mozilla.org/security/announce/2016/mfs…	x_refsource_CONFIRM
https://bugzilla.mozilla.org/show_bug.cgi?id=1284372	x_refsource_CONFIRM

Date Public

2016-08-02 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:53:48.950Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1036508",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1036508"
          },
          {
            "name": "92260",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/92260"
          },
          {
            "name": "GLSA-201701-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-15"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-82.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1284372"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-08-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a right-to-left character set."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-15T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "1036508",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1036508"
        },
        {
          "name": "92260",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/92260"
        },
        {
          "name": "GLSA-201701-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-15"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-82.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1284372"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2016-5267",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a right-to-left character set."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1036508",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1036508"
            },
            {
              "name": "92260",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/92260"
            },
            {
              "name": "GLSA-201701-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-15"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2016/mfsa2016-82.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-82.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1284372",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1284372"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2016-5267",
    "datePublished": "2016-08-05T01:00:00.000Z",
    "dateReserved": "2016-06-03T00:00:00.000Z",
    "dateUpdated": "2024-08-06T00:53:48.950Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-5268 (GCVE-0-2016-5268)

Vulnerability from cvelistv5 – Published: 2016-08-05 01:00 – Updated: 2024-08-06 00:53

Summary

Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring.

Severity

No CVSS data available.

CWE

Assigner

mozilla

References

8 references

URL	Tags
http://www.securitytracker.com/id/1036508	vdb-entryx_refsource_SECTRACK
https://bugzilla.mozilla.org/show_bug.cgi?id=1253673	x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-3044-1	vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/92260	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201701-15	vendor-advisoryx_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.mozilla.org/security/announce/2016/mfs…	x_refsource_CONFIRM

Date Public

2016-08-02 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:53:48.901Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1036508",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1036508"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1253673"
          },
          {
            "name": "USN-3044-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3044-1"
          },
          {
            "name": "92260",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/92260"
          },
          {
            "name": "GLSA-201701-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-15"
          },
          {
            "name": "openSUSE-SU-2016:1964",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html"
          },
          {
            "name": "openSUSE-SU-2016:2026",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-83.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-08-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-15T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "1036508",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1036508"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1253673"
        },
        {
          "name": "USN-3044-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3044-1"
        },
        {
          "name": "92260",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/92260"
        },
        {
          "name": "GLSA-201701-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-15"
        },
        {
          "name": "openSUSE-SU-2016:1964",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html"
        },
        {
          "name": "openSUSE-SU-2016:2026",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-83.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2016-5268",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1036508",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1036508"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1253673",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1253673"
            },
            {
              "name": "USN-3044-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3044-1"
            },
            {
              "name": "92260",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/92260"
            },
            {
              "name": "GLSA-201701-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-15"
            },
            {
              "name": "openSUSE-SU-2016:1964",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html"
            },
            {
              "name": "openSUSE-SU-2016:2026",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2016/mfsa2016-83.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-83.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2016-5268",
    "datePublished": "2016-08-05T01:00:00.000Z",
    "dateReserved": "2016-06-03T00:00:00.000Z",
    "dateUpdated": "2024-08-06T00:53:48.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2016-AVI-259

Solution

CVE-2016-5267 (GCVE-0-2016-5267)

CVE-2016-5268 (GCVE-0-2016-5268)

Tags

Sightings

Nomenclature