CVE-2016-9902
- State
- Published
- Severity
- Not scored
- Published
- Jun 11, 2018
- Updated
- Aug 6, 2024
- Reserved
- Dec 7, 2016
Description
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Firefox ESRMozilla |
|
FirefoxMozilla |
|
References
- https://www.mozilla.org/security/advisories/mfsa2016-94/
- https://www.mozilla.org/security/advisories/mfsa2016-95/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1320039
- 94885vdb-entry
- 1037461vdb-entry
- GLSA-201701-15vendor-advisory
- RHSA-2016:2973vendor-advisory
- RHSA-2016:2946vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.