CVE-2016-1958: Medium severity oracle linux vulnerability
Published Mar 13, 2016
·Updated
browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.
Affected Software
31 affected components
Oracle Linux=5.0
Oracle Linux=6
Oracle Linux=7
openSUSE openSUSE=13.1
Mozilla Firefox<=44.0.2
Mozilla Firefox=38.0
Mozilla Firefox=38.0.1
Mozilla Firefox=38.0.5
Mozilla Firefox=38.1.0
Mozilla Firefox=38.1.1
Mozilla Firefox=38.2.0
Mozilla Firefox=38.2.1
Mozilla Firefox=38.3.0
Mozilla Firefox=38.4.0
Mozilla Firefox=38.5.0
Mozilla Firefox=38.5.1
Mozilla Firefox=38.6.0
Mozilla Firefox=38.6.1
Mozilla Firefox ESR=38.0
Mozilla Firefox ESR=38.0.1
Mozilla Firefox ESR=38.0.5
Mozilla Firefox ESR=38.1.0
Mozilla Firefox ESR=38.1.1
Mozilla Firefox ESR=38.2.0
Mozilla Firefox ESR=38.2.1
Mozilla Firefox ESR=38.3.0
Mozilla Firefox ESR=38.4.0
Mozilla Firefox ESR=38.5.0
Mozilla Firefox ESR=38.5.1
Mozilla Firefox ESR=38.6.0
Mozilla Firefox ESR=38.6.1
Event History
Mar 13, 2016
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1958?
CVE-2016-1958 is rated as a moderate severity vulnerability.
2
How do I fix CVE-2016-1958?
To fix CVE-2016-1958, update your Mozilla Firefox or Firefox ESR to version 45.0 or later.
3
What kind of attack does CVE-2016-1958 enable?
CVE-2016-1958 allows remote attackers to spoof the browser's address bar through a specially crafted javascript: URL.
4
Which versions of Firefox are affected by CVE-2016-1958?
CVE-2016-1958 affects Mozilla Firefox versions prior to 45.0 and Firefox ESR versions prior to 38.7.
5
Can CVE-2016-1958 be exploited in a phishing attack?
Yes, CVE-2016-1958 can be exploited in phishing attacks by misleading users with spoofed URLs in the address bar.