CVE-2016-5282

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-52838.8Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute CVE-2016-52847.4Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public K CVE-2016-52857.5A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ss CVE-2016-52879.8A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier th CVE-2016-52885.9Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those page CVE-2016-52899.8Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effo CVE-2016-52909.8Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume CVE-2016-52915.5A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45 CVE-2016-52926.5During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.CVE-2016-52935.5When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitra CVE-2016-52945.5The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vul CVE-2016-52957.8This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke