When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly loaded page. This allows for spoofing attacks. This vulnerability affects Firefox < 52.
Al arrastrar contenido del panel del navegador primario a la barra de direcciones de un sitio web malicioso, es posible cambiar la barra de direcciones para que la localización después de la navegación no coincida con la URL de la nueva página cargada. Esto permite ataques de suplantación. La vulnerabilidad afecta a Firefox en versiones anteriores a la 52.
USN-3216-1 fixed vulnerabilities in Firefox. The update resulted in a startup crash when Firefox is used with XRDP. This update fixes the problem. Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to bypass same origin restrictions, obtain sensitive information, spoof the addressbar, spoof the print dialog, cause a denial of service via application crash or hang, or execute arbitrary code. Various other issues were also addressed.
