Bugzilla – Bug 983922
VUL-0: CVE-2016-2830: MozillaFirefox: Favicon network connection persists when page is closed
Last modified: 2019-11-05 15:38:52 UTC
rh#1342897 redhat uses https://www.mozilla.org/en-US/security/advisories/mfsa2016-58/ as reference, but that page does not list CVE-2016-2830 Security researcher Toni Huttunen reported that once the favicon is requested from a site, the favicon network connection will persist even when the page is later closed. This allows a malicious site to continue to use this channel to send requests to the browser, leading to potential information disclosure, such as the IP address of the user. Acknowledgements: Name: the Mozilla project Upstream: Toni Huttunen References: https://bugzilla.redhat.com/show_bug.cgi?id=1342897 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2830
bugbot adjusting priority
https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/ Fixed in Firefox 48, Firefox ESR 45.3 Already fixed in: SUSE:SLE-11-SP1:Update SUSE:SLE-11-SP3:Update SUSE:SLE-12:Update
closing
SUSE-SU-2019:2872-1: An update that fixes 51 vulnerabilities is now available. Category: security (important) Bug References: 1010399,1010405,1010406,1010408,1010409,1010421,1010423,1010424,1010425,1010426,1025108,1043008,1047281,1074235,1092611,1120374,1137990,1149429,1154738,959933,983922 CVE References: CVE-2016-2830,CVE-2016-5289,CVE-2016-5292,CVE-2016-9063,CVE-2016-9067,CVE-2016-9068,CVE-2016-9069,CVE-2016-9071,CVE-2016-9073,CVE-2016-9075,CVE-2016-9076,CVE-2016-9077,CVE-2017-7789,CVE-2018-5150,CVE-2018-5151,CVE-2018-5152,CVE-2018-5153,CVE-2018-5154,CVE-2018-5155,CVE-2018-5157,CVE-2018-5158,CVE-2018-5159,CVE-2018-5160,CVE-2018-5163,CVE-2018-5164,CVE-2018-5165,CVE-2018-5166,CVE-2018-5167,CVE-2018-5168,CVE-2018-5169,CVE-2018-5172,CVE-2018-5173,CVE-2018-5174,CVE-2018-5175,CVE-2018-5176,CVE-2018-5177,CVE-2018-5178,CVE-2018-5179,CVE-2018-5180,CVE-2018-5181,CVE-2018-5182,CVE-2018-5183,CVE-2019-11757,CVE-2019-11758,CVE-2019-11759,CVE-2019-11760,CVE-2019-11761,CVE-2019-11762,CVE-2019-11763,CVE-2019-11764,CVE-2019-15903 Sources used: SUSE OpenStack Cloud Crowbar 8 (src): MozillaFirefox-68.2.0-109.95.2 SUSE OpenStack Cloud 8 (src): MozillaFirefox-68.2.0-109.95.2 SUSE OpenStack Cloud 7 (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server for SAP 12-SP3 (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server for SAP 12-SP2 (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server for SAP 12-SP1 (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server 12-SP5 (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server 12-SP4 (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server 12-SP3-LTSS (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server 12-SP3-BCL (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server 12-SP2-LTSS (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server 12-SP2-BCL (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Server 12-SP1-LTSS (src): MozillaFirefox-68.2.0-109.95.2 SUSE Linux Enterprise Desktop 12-SP4 (src): MozillaFirefox-68.2.0-109.95.2 SUSE Enterprise Storage 5 (src): MozillaFirefox-68.2.0-109.95.2 HPE Helion Openstack 8 (src): MozillaFirefox-68.2.0-109.95.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.