CVE-2016-1949

EUVD-2016-3038
Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
≤ 44.0.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
110
111
102
105
110
111
110
111
firefox-esr
102
105
102
105
102
105
102
105
110
111
102
105
110
111
102
105
110
111
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
114
101
114
101
105
103
114
101
thunderbird
110
111
100
110
110
111
110
111
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-updates/2016-02/msg00102.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00142.html
http://www.mozilla.org/security/announce/2016/mfsa2016-13.html
http://www.securitytracker.com/id/1035007
http://www.ubuntu.com/usn/USN-2893-1
https://bugzilla.mozilla.org/show_bug.cgi?id=1245724
https://security.gentoo.org/glsa/201605-06
http://lists.opensuse.org/opensuse-updates/2016-02/msg00102.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00142.html
http://www.mozilla.org/security/announce/2016/mfsa2016-13.html
http://www.securitytracker.com/id/1035007
http://www.ubuntu.com/usn/USN-2893-1
https://bugzilla.mozilla.org/show_bug.cgi?id=1245724
https://security.gentoo.org/glsa/201605-06