CVE-2016-2820

NameCVE-2016-2820
DescriptionThe Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes it easier for remote attackers to modify sharing preferences by leveraging access to the remote-report IFRAME element.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firefox (PTS)sid126.0-1fixed
firefox-esr (PTS)jessie, jessie (lts)68.9.0esr-1~deb8u2fixed
stretch (security), stretch (lts), stretch91.11.0esr-1~deb9u1fixed
buster91.12.0esr-1~deb10u1fixed
buster (security)115.11.0esr-1~deb10u1fixed
bullseye115.7.0esr-1~deb11u1fixed
bullseye (security)115.11.0esr-1~deb11u1fixed
bookworm115.7.0esr-1~deb12u1fixed
bookworm (security)115.11.0esr-1~deb12u1fixed
sid, trixie115.11.0esr-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firefoxsource(unstable)46.0-1
firefox-esrsource(unstable)(not affected)
iceweaselsource(unstable)(not affected)

Notes

- iceweasel <not-affected> (Only Firefox 46)
- firefox-esr <not-affected> (Only Firefox 46)
https://www.mozilla.org/en-US/security/advisories/mfsa2016-48/

Search for package or bug name: Reporting problems