CVE-2016-5250 — Sensitive Information Exposure in Firefox

CWE-200 — Sensitive Information Exposure10 documents7 sources
Severity
4.3MEDIUMNVD
OSV9.8
EPSS
0.5%
top 32.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla ThunderbirdDebian Firefox+1 more
Timeline
PublishedAug 5
Latest updateMay 14

Description

Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved page via Resource Timing API calls.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶Ubuntumozilla/firefox< 48.0+build2-0ubuntu0.14.04.1+1
▶NVDmozilla/firefox47.0.1
▶debiandebian/firefox< firefox 48.0-1 (sid)
▶debiandebian/firefox-esr< firefox 48.0-1 (sid)
▶Ubuntumozilla/thunderbird< 1:45.4.0+build1-0ubuntu0.14.04.1+1

🔴Vulnerability Details

4
GHSA
GHSA-w8fm-f723-jm45: Mozilla Firefox before 48↗2022-05-14
▶
OSV
thunderbird vulnerabilities↗2016-10-27
▶
OSV
CVE-2016-5250: Mozilla Firefox before 48↗2016-08-05
▶
OSV
firefox vulnerabilities↗2016-08-05
▶

📋Vendor Advisories

4
Ubuntu
Thunderbird vulnerabilities↗2016-10-27
▶
Red Hat
Mozilla: Resource Timing API is storing resources sent by the previous page (MFSA 2016-84, MFSA 2016-86)↗2016-09-20
▶
Ubuntu
Firefox vulnerabilities↗2016-08-05
▶
Debian
CVE-2016-5250: firefox - Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow rem...↗2016
▶

💬Community

1
Bugzilla
CVE-2016-5250 Mozilla: Resource Timing API is storing resources sent by the previous page (MFSA 2016-84, MFSA 2016-86)↗2016-08-01
▶