CVE-2016-1943: Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via the scrollTo method

Medium severity · published Jan 31, 2016

CVE-2016-1943

Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via the scrollTo method

4.7

CVSS

EPSS

On KEV

Description

Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via the scrollTo method.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 61% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Android · Google

All versions, or not specified · source: NVD

Firefox · Mozilla

43.0.4 · source: NVD

Leap · Opensuse

42.1 · source: NVD

Opensuse · Opensuse

13.1; 13.2 · source: NVD

Affected product

Android

Google

All Android CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-1943

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-1943

lists.opensuse.org

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html

lists.opensuse.org

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html

Vendor Advisory

http://www.mozilla.org/security/announce/2016/mfsa2016-09.html

www.securityfocus.com

http://www.securityfocus.com/bid/81948

www.securitytracker.com

http://www.securitytracker.com/id/1034825

bugzilla.mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1228590