CVE-2016-2810
published 2016-04-30CVE-2016-2810: Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass intended Signature access requirements via a crafted application that leverages…
PriorityP420medium5CVSS 3.0
AVLACLPRLUIRSUCHINAN
EPSS
0.85%
54.6th percentile
Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass intended Signature access requirements via a crafted application that leverages content-provider permissions, as demonstrated by reading the browser history or a saved password.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| debian | firefox-esr | — | — |
| mozilla | firefox | <= 45.0.2 | — |
CVSS provenance
nvdv3.05.0MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Mozilla: Content provider permission bypass allows malicious application to access data (MFSA 2016-41)
vendor_redhat·2016-04-26·CVSS 5.0
CVE-2016-2810 [MEDIUM] Mozilla: Content provider permission bypass allows malicious application to access data (MFSA 2016-41)
Mozilla: Content provider permission bypass allows malicious application to access data (MFSA 2016-41)
Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass intended Signature access requirements via a crafted application that leverages content-provider permissions, as demonstrated by reading the browser history or a saved password.
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2016-2810: firefox - Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass int...
vendor_debian·2016·CVSS 5.0
CVE-2016-2810 [MEDIUM] CVE-2016-2810: firefox - Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass int...
Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass intended Signature access requirements via a crafted application that leverages content-provider permissions, as demonstrated by reading the browser history or a saved password.
Scope: local
sid: resolved
GHSA
GHSA-73hr-36wp-4xmc: Mozilla Firefox before 46
ghsa_unreviewed·2022-05-17
CVE-2016-2810 [MEDIUM] GHSA-73hr-36wp-4xmc: Mozilla Firefox before 46
Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass intended Signature access requirements via a crafted application that leverages content-provider permissions, as demonstrated by reading the browser history or a saved password.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.htmlhttp://www.mozilla.org/security/announce/2016/mfsa2016-41.htmlhttp://www.securitytracker.com/id/1035692https://bugzilla.mozilla.org/show_bug.cgi?id=1229681https://security.gentoo.org/glsa/201701-15http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.htmlhttp://www.mozilla.org/security/announce/2016/mfsa2016-41.htmlhttp://www.securitytracker.com/id/1035692https://bugzilla.mozilla.org/show_bug.cgi?id=1229681https://security.gentoo.org/glsa/201701-15
2016-04-30
Published