7.5

CVE-2016-9902

Exploit
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version < 45.6.0
Mozilla ≫ Firefox Version < 50.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.32% 0.684
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

https://security.gentoo.org/glsa/201701-15
Third Party Advisory
http://www.securitytracker.com/id/1037461
Third Party Advisory
VDB Entry
https://www.mozilla.org/security/advisories/mfsa2016-94/
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2946.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2973.html
Third Party Advisory
http://www.securityfocus.com/bid/94885
Third Party Advisory
VDB Entry
https://www.mozilla.org/security/advisories/mfsa2016-95/
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1320039
Patch
Exploit
Issue Tracking