Access Restriction Bypass Affecting firefox package, versions <46.0-1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIANUNSTABLE-FIREFOX-423112
- published 30 Apr 2016
- disclosed 30 Apr 2016
Introduced: 30 Apr 2016
CVE-2016-2817 Open this link in a new tabHow to fix?
Upgrade Debian:unstable
firefox
to version 46.0-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream firefox
package and not the firefox
package as distributed by Debian
.
See How to fix?
for Debian:unstable
relevant fixed versions and status.
The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict principal inheritance during chrome.tabs.create and chrome.tabs.update API calls, which allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted extension that accesses a (1) javascript: or (2) data: URL.
References
- https://security-tracker.debian.org/tracker/CVE-2016-2817
- https://security.gentoo.org/glsa/201701-15
- http://www.mozilla.org/security/announce/2016/mfsa2016-46.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1227462
- http://www.securitytracker.com/id/1035692
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2817
- http://www.ubuntu.com/usn/USN-2936-1
- http://www.ubuntu.com/usn/USN-2936-2
- http://www.ubuntu.com/usn/USN-2936-3