Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade libxulUpgrade linux-firefoxUpgrade seamonkeyUpgrade firefox-esrUpgrade linux-thunderbirdUpgrade thunderbirdUpgrade linux-seamonkeyUpgrade firefox | Dec 10, 2025 | Sep 7, 2016 |
| Gentoo Linux | — | Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox. | Oct 30, 2017 | Aug 4, 2016 |
| Mfsa2016 83 | — | Upgrade to Mozilla Firefox version 48.0Upgrade to the latest version of Mozilla Firefox | Aug 3, 2016 | Aug 2, 2016 |
| Suse | — | Upgrade MozillaFirefox-translations-commonUpgrade MozillaFirefoxUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-devel | Aug 22, 2016 | Aug 4, 2016 |
| Ubuntu | — | Upgrade firefox | Aug 6, 2016 | Aug 4, 2016 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub