CVE-2016-5282: Infoleak
Favicons can be loaded through non-whitelisted protocols, such as jar:.
Other sources
Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource.
— Launchpad
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2016-5282?
CVE-2016-5282 is a vulnerability in Mozilla Firefox before version 49.0 that allows remote attackers to obtain sensitive information via unspecified vectors by loading favicons through non-whitelisted protocols such as jar:.
How does CVE-2016-5282 impact Mozilla Firefox?
CVE-2016-5282 impacts Mozilla Firefox before version 49.0 by not properly restricting the scheme in favicon requests, potentially leading to the disclosure of sensitive information.
What is the severity of CVE-2016-5282?
The severity of CVE-2016-5282 is medium with a CVSS score of 6.5.
How can I fix CVE-2016-5282 in Mozilla Firefox?
To fix CVE-2016-5282 in Mozilla Firefox, update to version 49.0 or later.
Are there any references for CVE-2016-5282?
Yes, you can find references for CVE-2016-5282 at the following links: [link1](https://bugzilla.mozilla.org/show_bug.cgi?id=932335), [link2](https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/), [link3](http://www.mozilla.org/security/announce/2016/mfsa2016-85.html).