Bug 1387588 (CVE-2016-5288)

Summary:	CVE-2016-5288 firefox: Web content can read cache entries
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fweimer, gecko-bugs-nobody, jhorak, pjasicek, stransky
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	firefox 49.0.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:00:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1387589
Bug Blocks:

Description Andrej Nemec 2016-10-21 10:33:44 UTC

It was demonstrated that web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49.

Upstream bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=1310183

Comment 1 Andrej Nemec 2016-10-21 10:34:30 UTC

Created firefox tracking bugs for this issue:

Affects: fedora-all [bug 1387589]