Mozilla employee Mike Kaply reported that the Firefox session restore data can contain passwords in plain text if a password input field on a page has its type changed from "password" to "text" during a session. This can occur if the password input field has a scripted mechanism to display the password to the user. Once this type is changed, the password data will persist as clear text within stored form data for this page. This could result in a potential revelation of site passwords on sites that use this mechanism to display password data if an attacker could find a way to read the session restoration file. 


External Reference:

https://www.mozilla.org/security/announce/2016/mfsa2016-74.html


Acknowledgements:

Name: the Mozilla project
Upstream: Mike Kaply

Statement:

This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.