CVE-2016-2820
Publication date 27 April 2016
Last updated 25 August 2025
Ubuntu priority
Description
The Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes it easier for remote attackers to modify sharing preferences by leveraging access to the remote-report IFRAME element.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 16.04 LTS xenial |
Fixed 46.0+build5-0ubuntu0.16.04.2
|
| 14.04 LTS trusty |
Fixed 46.0+build5-0ubuntu0.14.04.2
|
|
| thunderbird | 16.04 LTS xenial |
Not affected
|
| 14.04 LTS trusty | Not in release | |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
4.3 · Medium
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
Related Ubuntu Security Notices (USN)
- USN-2936-1
- Firefox vulnerabilities
- 27 April 2016