CVE-2016-5265

CVSS v3.0 5.5 (Medium)

CVSS v2.0 4 (Medium)

EPSS 0.15 % (51^th)

Affected Products 3

Advisories 11

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.

Weaknesses

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE Status: PUBLISHED
CNA: Mozilla Corporation
Published Date: 2016-08-05 01:59:21
(8 years ago)
Updated Date: 2019-12-27 16:08:55
(4 years ago)

Affected Products

Mozilla

Oracle

Linux

Configuration #1

		CPE23	From	Up To
	Oracle Linux 5.0	cpe:2.3:o:oracle:linux:5.0
	Oracle Linux 6	cpe:2.3:o:oracle:linux:6
	Oracle Linux 7	cpe:2.3:o:oracle:linux:7

Configuration #2

	CPE23	Up To
Mozilla Firefox 47.0.1 and prior versions	cpe:2.3:a:mozilla:firefox	<= 47.0.1
Mozilla Firefox Esr 45.1.0	cpe:2.3:a:mozilla:firefox_esr:45.1.0
Mozilla Firefox Esr 45.1.1	cpe:2.3:a:mozilla:firefox_esr:45.1.1
Mozilla Firefox Esr 45.2.0	cpe:2.3:a:mozilla:firefox_esr:45.2.0
Mozilla Firefox Esr 45.3.0	cpe:2.3:a:mozilla:firefox_esr:45.3.0