Bug 963638 (CVE-2016-1940) - VUL-0: CVE-2016-1940: MozillaFirefox: Addressbar spoofing through stored data url shortcuts on Firefox for Android
Summary: VUL-0: CVE-2016-1940: MozillaFirefox: Addressbar spoofing through stored data...
Status: RESOLVED INVALID
Alias: CVE-2016-1940
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: All Android 5.0.x
: P5 - None : Critical
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on: 963520
Blocks:
  Show dependency tree / graph
 
Reported: 2016-01-26 18:14 UTC by Andreas Stieger
Modified: 2016-01-26 18:14 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2016-01-26 18:14:06 UTC 
https://www.mozilla.org/en-US/security/advisories/mfsa2016-05/

Security researcher Muneaki Nishimura reported an issue with displayed URLs and bookmarks on Firefox for Android. If a data: URL is opened from a stored shortcut on the homescreen or from a BOOKMARK intent from another installed Android application, the addressbar continues to show the data: url even if the content redirects to another page, hiding the true origin of the content. This was due to an error in how hosts were handled with data: URLs. 

This issue only affects Firefox for Android. Firefox on other operating systems is not affected.

https://bugzilla.mozilla.org/show_bug.cgi?id=1208525
Comment 1 Andreas Stieger 2016-01-26 18:14:31 UTC 
Not affecting SUSE or openSUSE platforms.