#VU1041 Information disclosure in Mozilla Firefox - CVE-2016-5288

Vulnerability identifier: #VU1041

Vulnerability risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-5288

CWE-ID: CWE-416

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Mozilla Firefox
Client/Desktop applications / Web browsers

Vendor: Mozilla

Description
The vulnerability allows a remote unauthenticated user to access potentially sensitive information on the target system.
The weakness is due to insufficient input validation. By tricking the victim to download a specially crafted content, attackers can view potentially sensitive URL and page content from the HTTP cache.
Successful exploitation of the vulnerability results in disclosure of important data on the vulnerable system.

Mitigation
Update to version 49.0.2.

Vulnerable software versions

Mozilla Firefox: 48.0 b1 - 49.0.1

---

External links
https://www.mozilla.org/en-US/security/advisories/mfsa2016-87/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.