Improper authorization control for web services In firefox
Description
Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel7 | 0:38.3.0-1.el7_1 | ||
rpm rhel6 | 0:38.3.0-2.el6_7 | ||
rpm rhel7 | 0:38.3.0-2.el7_1 | ||
rpm rhel5 | 0:38.3.0-2.el5_11 | ||
rpm rhel5 | 0:38.3.0-1.el5_11 | ||
rpm rhel6 | 0:38.3.0-1.el6_7 |
Aliases
1. 2. 3.