CVE-2016-9061

Publication date 11 June 2018

Last updated 24 July 2024


Ubuntu priority

Cvss 3 Severity Score

7.5 · High

Score breakdown

A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox only. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.

Read the notes from the security team

Status

Package Ubuntu Release Status
firefox 16.10 yakkety
Not affected
16.04 LTS xenial
Not affected
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected
thunderbird 16.10 yakkety
Not affected
16.04 LTS xenial
Not affected
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected

Notes


sbeattie

firefox for android only

Severity score breakdown

Parameter Value
Base score 7.5 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N