CVE-2016-2831
high
CVSS v3
8.8
CVSS v2
5.8
VIR risk
8.8
Description
Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service (UI outage), or conduct clickjacking or spoofing attacks, via a crafted web site.
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2016-2831
Vendor advisory: security@mozilla.org — http://www.mozilla.org/security/announce/2016/mfsa2016-58.html
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2016-2831.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | sid | fixed | 47.0-1 |
| debian | bookworm | fixed | 45.2.0esr-1 |
| debian | bullseye | fixed | 45.2.0esr-1 |
| debian | forky | fixed | 45.2.0esr-1 |
| debian | trixie | fixed | 45.2.0esr-1 |
| ubuntu | 12.04 | affected | |
| ubuntu | 14.04 | affected | |
| ubuntu | 15.10 | affected | |
| ubuntu | 16.04 | affected | |
| debian | 8.0 | affected | |
| suse | 42.1 | affected | |
| suse | 13.1 | affected | |
| suse | 13.2 | affected | |
References
- https://www.suse.com/security/cve/CVE-2016-2831.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
- http://www.debian.org/security/2016/dsa-3600
- http://www.mozilla.org/security/announce/2016/mfsa2016-58.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/91075
- http://www.securitytracker.com/id/1036057
- http://www.ubuntu.com/usn/USN-2993-1
- https://access.redhat.com/errata/RHSA-2016:1217
- https://bugzilla.mozilla.org/show_bug.cgi?id=1261933
- https://security-tracker.debian.org/tracker/CVE-2016-2831
CWEs
CWE-254 CWE-284
Verify integrity in audit chain (admin only). AS-IS.