CVE-2016-2830

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses.

• CWE-200

• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html
• http://rhn.redhat.com/errata/RHSA-2016-1551.html
• http://www.debian.org/security/2016/dsa-3640
• http://www.mozilla.org/security/announce/2016/mfsa2016-63.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
• http://www.securityfocus.com/bid/92261
• http://www.securitytracker.com/id/1036508
• http://www.ubuntu.com/usn/USN-3044-1
• https://bugzilla.mozilla.org/show_bug.cgi?id=1255270Issue Tracking, Permissions Required
• https://security.gentoo.org/glsa/201701-15
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html
• http://rhn.redhat.com/errata/RHSA-2016-1551.html
• http://www.debian.org/security/2016/dsa-3640
• http://www.mozilla.org/security/announce/2016/mfsa2016-63.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
• http://www.securityfocus.com/bid/92261
• http://www.securitytracker.com/id/1036508
• http://www.ubuntu.com/usn/USN-3044-1
• https://bugzilla.mozilla.org/show_bug.cgi?id=1255270Issue Tracking, Permissions Required
• https://security.gentoo.org/glsa/201701-15

Published

Aug 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2824The TSymbolTableLevel class in ANGLE, as used in Mozilla Fir…
• CVE-2016-2825Mozilla Firefox before 47.0 allows remote attackers to bypas…
• CVE-2016-2826The maintenance service in Mozilla Firefox before 47.0 and F…
• CVE-2016-2827The mozilla::net::IsValidReferrerPolicy function in Mozilla …
• CVE-2016-2828Use-after-free vulnerability in Mozilla Firefox before 47.0 …
• CVE-2016-2829Mozilla Firefox before 47.0 allows remote attackers to spoof…
• CVE-2016-2831Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2…
• CVE-2016-2832Mozilla Firefox before 47.0 allows remote attackers to disco…
• CVE-2016-2833Mozilla Firefox before 47.0 ignores Content Security Policy …
• CVE-2016-2834Mozilla Network Security Services (NSS) before 3.23, as used…
• CVE-2016-2835Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2016-2836Multiple unspecified vulnerabilities in the browser engine i…