Summary
Abdulrahman Alqabandi and Ben Kelly discovered that the fetch() API did
not correctly implement the Cross Origin Resource Sharing (CORS)
specification. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to obtain sensitive
information from other origins. (CVE-2015-7184)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | firefox | 41.0.2+build2-0ubuntu0.14.04.1 |
Vulnerabilities 1
-
Unscored —
The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in cer…
References
-
report
https://ubuntu.com/security/CVE-2015-7184