CVE-2016-5251

Mozilla Firefox en versiones anteriores a 48.0 permite a atacantes remotos suplantar la barra de direcciones a través de caracteres manipulados en el formato de un data: URL.

Gustavo Grieco discovered an out-of-bounds read during XML parsing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or obtain sensitive information. Toni Huttunen discovered that once a favicon is requested from a site, the remote server can keep the network connection open even after the page is closed. A remote attacker could potentially exploit this to track users, resulting in information disclosure. Various other issues were also addressed.