CVE-2016-1948 — Vulnetix

Try Vulnetix Request Demo

CVE-2016-1948 PUBLISHED CVSS 5.300000190734863 MEDIUM

Mozilla Firefox before 44.0 on Android does not ensure that HTTPS is used for a lightweight-theme installation, which allows man-in-the-middle attackers to replace a theme's images and colors by modifying the client-server data stream.

EPSS 0.22% · 44.4th percentile

Risk Scores

CVSS v3.0

5.300000190734863

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Score

0.22%

44.4th percentile

Affected Products

Vendor	Product	Versions
mozilla	firefox	43.0.4
n/a	n/a	n/a
google	android

Timeline

Jan 27, 2016 CVE Published
Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
May 19, 2022 EPSS Score
Jul 10, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Oct 23, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Feb 4, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score
May 19, 2023 EPSS Score

References

1034825 vdb
http://www.mozilla.org/security/announce/2016/mfsa2016-12.html url
https://bugzilla.mozilla.org/show_bug.cgi?id=1235876 url
GLSA-201605-06 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1948 advisory

Open in Interactive Console →