[arch-security] [ASA-201510-10] firefox: cross-origin restriction bypass
rgacogne at archlinux.org
Fri Oct 16 09:58:35 UTC 2015
Arch Linux Security Advisory ASA-201510-10
Date : 2015-10-16
CVE-ID : CVE-2015-7184
Package : firefox
Type : cross-origin restriction bypass
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package firefox before version 41.0.2-1 is vulnerable to
cross-origin restriction bypass.
Upgrade to 41.0.2-1.
# pacman -Syu "firefox>=41.0.2-1"
The problem has been fixed upstream in version 41.0.2.
Security researcher Abdulrahman Alqabandi reported that the fetch() API
did not correctly implement the Cross-Origin Resource Sharing (CORS)
specification, allowing a malicious page to access private data from
other origins. Mozilla developer Ben Kelly independently reported the
A remote attacker can bypass the cross-origin resource sharing policy to
access sensitive information.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: OpenPGP digital signature
More information about the arch-security