CVE-2016-2813
published 2016-04-30CVE-2016-2813: Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain…
PriorityP429medium6.5CVSS 3.0
AVNACLPRNUIRSUCHINAN
EPSS
1.44%
70.5th percentile
Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment, and possibly discover PIN values, via a crafted web site, a similar issue to CVE-2016-1780.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| debian | firefox-esr | — | — |
| mozilla | firefox | <= 45.0.2 | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_debian4.3LOW
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x4mq-76g8-78f6: Mozilla Firefox before 46
ghsa_unreviewed·2022-05-17·CVSS 4.3
CVE-2016-2813 [MEDIUM] CWE-200 GHSA-x4mq-76g8-78f6: Mozilla Firefox before 46
Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment, and possibly discover PIN values, via a crafted web site, a similar issue to CVE-2016-1780.
Red Hat
Mozilla: Disclosure of user actions through JavaScript with motion and orientation sensors (MFSA 2016-43)
vendor_redhat·2016-04-26·CVSS 4.3
CVE-2016-2813 [MEDIUM] Mozilla: Disclosure of user actions through JavaScript with motion and orientation sensors (MFSA 2016-43)
Mozilla: Disclosure of user actions through JavaScript with motion and orientation sensors (MFSA 2016-43)
Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment, and possibly discover PIN values, via a crafted web site, a similar issue to CVE-2016-1780.
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2016-2813: firefox - Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript acc...
vendor_debian·2016·CVSS 4.3
CVE-2016-2813 [MEDIUM] CVE-2016-2813: firefox - Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript acc...
Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment, and possibly discover PIN values, via a crafted web site, a similar issue to CVE-2016-1780.
Scope: local
sid: resolved
No detection rules found.
No public exploits indexed.
http://dl.acm.org/citation.cfm?id=2714650http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.htmlhttp://www.mozilla.org/security/announce/2016/mfsa2016-43.htmlhttp://www.securitytracker.com/id/1035692https://bugzilla.mozilla.org/show_bug.cgi?id=1197901https://security.gentoo.org/glsa/201701-15http://dl.acm.org/citation.cfm?id=2714650http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.htmlhttp://www.mozilla.org/security/announce/2016/mfsa2016-43.htmlhttp://www.securitytracker.com/id/1035692https://bugzilla.mozilla.org/show_bug.cgi?id=1197901https://security.gentoo.org/glsa/201701-15
2016-04-30
Published