CVE-2016-2811: Undefined Security Weakness

Use-after-free vulnerability in the ServiceWorkerInfo class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code via vectors related to the BeginReading method...

CVE-2016-2812

Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow and application crash via a crafted web site...

CVE-2016-2811

Use-after-free vulnerability in the ServiceWorkerInfo class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code via vectors related to the BeginReading method...

UBUNTU-CVE-2016-2811

Use-after-free vulnerability in the ServiceWorkerInfo class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code via vectors related to the BeginReading method...

UBUNTU-CVE-2016-2812

Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow and application crash via a crafted web site...

Ubuntu 14.04 LTS : Firefox regressions (USN-2917-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2917-2 advisory. USN-2917-1 fixed vulnerabilities in Firefox. This update caused several regressions that could result in search engine settings being lost, the list of search...

openSUSE Security Update : MozillaFirefox / mozilla-nspr / mozilla-nss (openSUSE-2016-332)

This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues : MozillaFirefox was updated to Firefox 45.0 boo969894 - requires NSPR 4.12 / NSS 3.21.1 - Instant browser tab sharing through Hello - Synced Tabs button in button bar - Tabs synced via Firefox Accounts from othe...

FreeBSD : mozilla -- multiple vulnerabilities (2225c5b4-1e5a-44fc-9920-b3201c384a15)

Mozilla Foundation reports : MFSA 2016-16 Miscellaneous memory safety hazards rv:45.0 / rv:38.7 MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports MFSA 2016-18 CSP reports fail to strip location information for embedded iframe pages MFSA 2016-19 Linux video...

Google Chrome Blink Information Disclosure Vulnerability (CNVD-2016-01502)

Blink is the United States Google Google Inc. and Norway Opens Opera Software company jointly developed a set of browser layout engine rendering engine. A security vulnerability exists in the Content Security Policy CSP implementation of Blink used in versions of Google Chrome prior to...

UBUNTU-CVE-2016-1959

The ServiceWorkerManager class in Mozilla Firefox before 45.0 allows remote attackers to execute arbitrary code or cause a denial of service out-of-bounds read and memory corruption via unspecified use of the Clients API...

chromium-browser: CSP implementation in Blink does not ignore a URL's path component in the case of a ServiceWorker fetch

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

UBUNTU-CVE-2016-2845

The Content Security Policy CSP implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation report...

Service workers and base URIs

Previously when we've run into a contentious service worker design issue, we've asked web developers what they think. This has worked out pretty well in the past, with developer feedback directly informing spec changes. It's also great because we can blame y'all if you pick the wrong thing. Well,...

Google Chrome ServiceWorker Memory Misreference Vulnerability

Google Chrome is an open source WEB browser. Google Chrome contains a memory misreference vulnerability in the content/browser/serviceworker/embeddedworkerinstance.cc file in the ServiceWorker implementation that allows attackers to construct malicious WEB pages that can be tricked into parsing t...

chromium-browser: Use-after-free in ServiceWorker

Use-after-free vulnerability in content/browser/serviceworker/embeddedworkerinstance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a...

UBUNTU-CVE-2015-6757

Use-after-free vulnerability in content/browser/serviceworker/embeddedworkerinstance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a...

Google Chrome Access Restriction Bypass

The vulnerability of the NavigatorServiceWorker::serviceWorker function in the Blink component of Google Chrome is related to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions when using...

Google Chrome Blink Same-Origin Policy Bypass Vulnerability (CNVD-2015-05805)

Google Chrome is a WEB-based browser. A vulnerability in the modules/serviceworkers/NavigatorServiceWorker.cpp NavigatorServiceWorker::serviceWorker function in Google Chrome Blink allows remote attackers to construct a malicious WEB page that can trick the user to parse it, which can bypass the...

CVE-2015-1292

The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker...

Design/Logic Flaw

The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker...