Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Firefox ESR older than 45.4 can leak page details

CVE-2016-5250 · published 10 years ago
Summary

Versions of Firefox ESR released before version 45.4 let a malicious website learn timing information about other pages you have visited. This can reveal details such as how long resources took to load, which may help an attacker infer what you were viewing. Update Firefox ESR to a newer version or apply the latest security patches to stop this behavior.

What to do
  • Update debian firefox-esr to version 45.4.0esr-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian firefox-esr < 45.4.0esr-1
Fix: upgrade to 45.4.0esr-1
Debian:13 debian firefox-esr < 45.4.0esr-1
Fix: upgrade to 45.4.0esr-1
Debian:14 debian firefox-esr < 45.4.0esr-1
Fix: upgrade to 45.4.0esr-1
– mozilla firefox <= 47.0.1
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Original advisory text
Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved page via Resource Timing API calls.
Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved page via Resource Timing API calls.
References
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published5 Aug 2016
Updated29 Oct 2026
First seen22 Sep 2026
Sources
DEBIAN-CVE-2016-5250 · OSV
CVE-2016-5250 · NVD
Track software like this
Free during beta