CVE-2016-1967

Priority
Description
Mozilla Firefox before 45.0 does not properly restrict the availability of
IFRAME Resource Timing API times, which allows remote attackers to bypass
the Same Origin Policy and obtain sensitive information via crafted
JavaScript code that leverages history.back and performance.getEntries
calls after restoring a browser session. NOTE: this vulnerability exists
because of an incomplete fix for CVE-2015-7207.
Assigned-to
chrisccoulson
Notes
Package
Upstream:released (45.0)
Ubuntu 14.04 ESM (Trusty Tahr):DNE (trusty was released [45.0+build2-0ubuntu0.14.04.1])
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (45.0+build2-0ubuntu1)
Package
Priority: Low
Upstream:not-affected
Ubuntu 14.04 ESM (Trusty Tahr):DNE (trusty was not-affected)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected
More Information

Updated: 2019-12-05 18:44:21 UTC (commit dd38ff22974aae499eb50644b9d5a2817483cbdb)