The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
22 Oct 2024, 13:42
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:mozilla:firefox_esr:38.2.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:38.0.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:38.3.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:38.1.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:38.2.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:38.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:38.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:38.1.1:*:*:*:*:*:*:* |
cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.2.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.2.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.4.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.3.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.1.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:* |
21 Oct 2024, 13:11
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:mozilla:firefox_esr:38.6.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:38.5.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:38.6.1:*:*:*:*:*:*:* |
cpe:2.3:a:mozilla:firefox:38.5.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.5.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.6.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:38.6.1:*:*:*:*:*:*:* |
Information
Published : 2016-03-13 18:59
Updated : 2024-10-22 13:42
NVD link : CVE-2016-1954
Mitre link : CVE-2016-1954
CVE.ORG link : CVE-2016-1954
JSON object : View
Products Affected
opensuse
- opensuse
- leap
mozilla
- thunderbird
- firefox
oracle
- linux
novell
- suse_package_hub_for_suse_linux_enterprise
CWE
CWE-264
Permissions, Privileges, and Access Controls