PT-2016-7633 · Mozilla+5 · Firefox+5

Julien Vehent

·

Publicado

2016-11-15

·

Atualizado

2024-12-12

·

CVE-2016-9064

CVSS v3.1

5.9

Média

VetorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 45.5 Firefox versions prior to 50
Description The issue arises from the failure of add-on updates to verify the add-on ID inside the signed package against the ID of the add-on being updated. This could allow an attacker, who can intercept the user's connection to the update server and bypass certificate pinning protection, to provide a malicious signed add-on instead of a valid update.
Recommendations For Firefox ESR versions prior to 45.5, update to version 45.5 or later. For Firefox versions prior to 50, update to version 50 or later.

Correção

Improper Certificate Validation

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2016-2307
ALT-PU-2017-1578
CESA-2016_2780
CVE-2016-9064
DLA-730-1
DSA-3716-1
MGASA-2016-0379
MGASA-2017-0323
OPENSUSE-SU-2016_2861-1
OPENSUSE-SU-2016_3011-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
RHSA-2016:2780
RHSA-2016_2780
SUSE-SU-2016:3014-1
SUSE-SU-2016:3080-1
SUSE-SU-2016:3105-1
USN-3124-1

Produtos afetados

Alt Linux
Centos
Firefox
Red Hat
Suse
Ubuntu