Summary
A use-after-free was discovered in service workers. If a user were tricked
in to opening a specially crafted website, an attacker could potentially
exploit this to cause a denial of service via program crash, or execute
arbitrary code. (CVE-2016-5287)
It was discovered that web content could access information in the HTTP
cache in some circumstances. An attacker could potentially exploit this
to obtain sensitive information. (CVE-2016-5288)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | firefox | 49.0.2+build2-0ubuntu0.14.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 49.0.2+build2-0ubuntu0.16.04.2 |
Vulnerabilities 2
-
Unscored —
A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affec…
-
Unscored —
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the c…