CVE-2016-2830

MEDIUM

Firefox < 48.0 and Firefox ESR 45.x < 45.3 - User Tracking via Favicon Connection Reuse

Title source: llm

Description

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses.

References (11)

Core 11

Core References

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3640

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-1551.html

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201701-15

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/92261

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1036508

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3044-1

Issue Tracking, Permissions Required x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=1255270

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2016/mfsa2016-63.html

Scores

CVSS v3 4.3

EPSS 0.0056

EPSS Percentile 68.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (5)

mozilla/firefox 45.1.0

mozilla/firefox 45.1.1

mozilla/firefox 45.2.0

mozilla/firefox 45.3.0

mozilla/firefox < 47.0.1

Published Aug 05, 2016

Tracked Since Feb 18, 2026