[go: up one dir, main page]
Bug 1015536 (CVE-2016-9901) - VUL-0: CVE-2016-9901: MozillaFirefox: Data from Pocket server improperly sanitized before execution
Summary: VUL-0: CVE-2016-9901: MozillaFirefox: Data from Pocket server improperly sani...
Status: RESOLVED FIXED
Alias: CVE-2016-9901
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Petr Cerny
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:SUSE:CVE-2016-9894:6.8:(AV:N/...
Keywords:
Depends on:
Blocks: 1015422
  Show dependency tree / graph
 
Reported: 2016-12-14 13:26 UTC by Marcus Meissner
Modified: 2019-05-01 12:55 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2016-12-14 13:26:21 UTC 
Security vulnerabilities fixed in Firefox 50.1
https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/

Discovered by: Wladimir Palant
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the about:pocket-saved (unprivileged) page, giving it access to Pocket's messaging API through HTML injection.

https://bugzilla.mozilla.org/show_bug.cgi?id=1320057
Comment 1 Swamp Workflow Management 2016-12-14 23:02:12 UTC 
bugbot adjusting priority
Comment 2 Petr Cerny 2017-08-10 14:54:28 UTC 
Released.