PT-2016-7645 · Mozilla+3 · Firefox+3

Alexander Inführ · Published 2016-11-28 · Updated 2024-12-12 · CVE-2016-9078

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions 49 through 50.0

Description The issue allows redirection from an HTTP connection to a "data:" URL, assigning the referring site's origin to the "data:" URL in certain circumstances. This can lead to same-origin violations against a domain if it loads resources from malicious sites. It has been demonstrated that cross-origin setting of cookies is possible without the ability to read them.

Recommendations For Firefox versions 49 through 50.0, update to version 50.0.1 or later to resolve the issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2016-2388

CVE-2016-9078

MGASA-2017-0323

OPENSUSE-SU-2016_2994-1

OPENSUSE-SU-2016_3011-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

USN-3140-1

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 2077

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1317641 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3140-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9078 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9078 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9079 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0323 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9078 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2016-94 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2016-91 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2016-87 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9078 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2016-91 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2016-89 · Vendor Advisory