CVE-2016-1965
Description
Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2016-1965 NameCVE-2016-1965 DescriptionMozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu,…
CVE-2016-1965
| Name | CVE-2016-1965 |
| Description | Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-3510-1 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| firefox (PTS) | sid | 151.0.3-1 | fixed |
| firefox-esr (PTS) | bullseye | 115.14.0esr-1~deb11u1 | fixed |
| bullseye (security) | 140.11.0esr-1~deb11u1 | fixed | |
| bookworm | 140.10.2esr-1~deb12u1 | fixed | |
| bookworm (security) | 140.11.0esr-1~deb12u1 | fixed | |
| trixie | 140.10.2esr-1~deb13u1 | fixed | |
| trixie (security) | 140.11.0esr-1~deb13u1 | fixed | |
| forky, sid | 140.11.0esr-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| firefox | source | (unstable) | 45.0-1 | |||
| firefox-esr | source | (unstable) | 45.0esr-1 | |||
| iceweasel | source | wheezy | 38.7.0esr-1~deb7u1 | DSA-3510-1 | ||
| iceweasel | source | jessie | 38.7.0esr-1~deb8u1 | DSA-3510-1 | ||
| iceweasel | source | (unstable) | (unfixed) |
Notes
https://www.mozilla.org/en-US/security/advisories/mfsa2016-28/
Apply commands
https://www.mozilla.org/en-US/security/advisories/mfsa2016-28/OS impact
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| 13.1 | Affected | — |
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 45.0esr-1 |
| sid | Fixed | 45.0-1 |
| forky | Fixed | 45.0esr-1 |
| bullseye | Fixed | 45.0esr-1 |
| bookworm | Fixed | 45.0esr-1 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| mozilla | firefox | {"endIncluding":"44.0.2"} | |
| mozilla | firefox | 38.0 | |
| mozilla | firefox | 38.0.1 | |
| mozilla | firefox | 38.0.5 | |
| mozilla | firefox | 38.1.0 | |
| mozilla | firefox | 38.1.1 | |
| mozilla | firefox | 38.2.0 | |
| mozilla | firefox | 38.2.1 | |
| mozilla | firefox | 38.3.0 | |
| mozilla | firefox | 38.4.0 | |
| mozilla | firefox | 38.5.0 | |
| mozilla | firefox | 38.5.1 | |
| mozilla | firefox | 38.6.0 | |
| mozilla | firefox | 38.6.1 | |
References
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html
- http://www.debian.org/security/2016/dsa-3510
- http://www.mozilla.org/security/announce/2016/mfsa2016-28.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securitytracker.com/id/1035215
- http://www.ubuntu.com/usn/USN-2917-1
- http://www.ubuntu.com/usn/USN-2917-2
- http://www.ubuntu.com/usn/USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245264
- https://security.gentoo.org/glsa/201605-06
- https://security-tracker.debian.org/tracker/CVE-2016-1965
CWEs
CWE-254
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.