First published: Tue Nov 15 2016(Updated: )
A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected.
Credit: security@mozilla.org
Affected Software | Affected Version | How to fix |
---|---|---|
Mozilla Firefox | <50 | 50 |
<50 | 50 | |
Mozilla Firefox | <50.0 | |
Google Android |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Found alongside the following vulnerabilities)
The CVE ID for this vulnerability is CVE-2016-5299.
This vulnerability affects Mozilla Firefox version up to exclusive 50 for Android.
The severity level of CVE-2016-5299 is medium, with a value of 4.
To fix CVE-2016-5299, update your Mozilla Firefox for Android to a version higher than 50.
You can find more information about CVE-2016-5299 in the Mozilla Security Advisory MFSA2016-89 and the Bugzilla entry.