Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7207.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mozilla
Published: 2016-03-13T18:00:00
Updated: 2016-12-01T15:57:02
Reserved: 2016-01-20T00:00:00
Link: CVE-2016-1967
JSON object: View
NVD Information
Status : Modified
Published: 2016-03-13T18:59:16.367
Modified: 2016-12-03T03:23:50.247
Link: CVE-2016-1967
JSON object: View
Redhat Information
No data.
CWE