Explain CVE-2016-1954
The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2016:0894', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.mozilla.org/releases/mozilla-release/rev/5154bb929236'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1243178'}, {'name': 'SUSE-SU-2016:0820', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html'}, {'name': 'openSUSE-SU-2016:1767', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'name': 'openSUSE-SU-2016:0731', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html'}, {'name': 'SUSE-SU-2016:0727', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html'}, {'name': 'openSUSE-SU-2016:1778', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2016/mfsa2016-17.html'}, {'name': 'openSUSE-SU-2016:0876', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html'}, {'name': 'USN-2917-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2917-1'}, {'name': 'DSA-3520', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3520'}, {'name': 'openSUSE-SU-2016:1769', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html'}, {'name': 'SUSE-SU-2016:0909', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html'}, {'name': 'DSA-3510', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3510'}, {'name': 'openSUSE-SU-2016:0733', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html'}, {'name': '1035215', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035215'}, {'name': 'SUSE-SU-2016:0777', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html'}, {'name': 'GLSA-201605-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201605-06'}, {'name': 'USN-2934-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2934-1'}, {'name': 'USN-2917-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2917-2'}, {'name': 'USN-2917-3', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2917-3'}]
CVE State: PUBLISHED