vulnerability
FreeBSD: firefox -- Same-origin-policy violation using Service Workers with plugins (CVE-2016-1949)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:M/Au:N/C:P/I:P/A:P) | Feb 12, 2016 | Feb 17, 2016 | Oct 30, 2017 |
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Feb 12, 2016
Added
Feb 17, 2016
Modified
Oct 30, 2017
Description
Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file.
Solutions
freebsd-upgrade-package-firefoxfreebsd-upgrade-package-linux-firefox
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.