Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Published

2018-06-11T21:29:02.357

Last Modified

2024-11-21T03:01:58.753

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-346

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	redhat	enterprise_linux_desktop	5.0	Yes
Operating System	redhat	enterprise_linux_desktop	6.0	Yes
Operating System	redhat	enterprise_linux_desktop	7.0	Yes
Operating System	redhat	enterprise_linux_server	5.0	Yes
Operating System	redhat	enterprise_linux_server	6.0	Yes
Operating System	redhat	enterprise_linux_server	7.0	Yes
Operating System	redhat	enterprise_linux_server_aus	7.3	Yes
Operating System	redhat	enterprise_linux_server_aus	7.4	Yes
Operating System	redhat	enterprise_linux_server_eus	7.3	Yes
Operating System	redhat	enterprise_linux_server_eus	7.4	Yes
Operating System	redhat	enterprise_linux_server_eus	7.5	Yes
Operating System	redhat	enterprise_linux_workstation	5.0	Yes
Operating System	redhat	enterprise_linux_workstation	6.0	Yes
Operating System	redhat	enterprise_linux_workstation	7.0	Yes
Application	mozilla	firefox	< 50.1	Yes
Application	mozilla	firefox_esr	< 45.6.0	Yes

References

http://rhn.redhat.com/errata/RHSA-2016-2946.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2016-2973.html Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/94885 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1037461 Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=1320039 Exploit, Issue Tracking, Patch ([email protected])
https://security.gentoo.org/glsa/201701-15 Third Party Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2016-94/ Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2016-95/ Vendor Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2016-2946.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2016-2973.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/94885 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1037461 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.mozilla.org/show_bug.cgi?id=1320039 Exploit, Issue Tracking, Patch (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/201701-15 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2016-94/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2016-95/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)