1. Home
  2. CVE Database
  3. CVE-2016-5265
MEDIUM · 5.5

CVE-2016-5265

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by...

Vulnerability Description

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.

CVSS Score

5.5

MEDIUM

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
OracleLinux5.0
MozillaFirefox<= 47.0.1

Related Weaknesses (CWE)

CWE-79CWE-200

References

FAQ

What is CVE-2016-5265?

CVE-2016-5265 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by...

How severe is CVE-2016-5265?

CVE-2016-5265 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-5265?

Check the references section above for vendor advisories and patch information. Affected products include: Oracle Linux, Mozilla Firefox.