Описание
Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| firefox | fixed | 139.0-1 | package |
Примечания
https://www.mozilla.org/en-US/security/advisories/mfsa2025-42/#CVE-2025-5271
EPSS
Связанные уязвимости
Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139.
Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139.
Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139.
Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability affects Firefox < 139.
Уязвимость функции предварительного просмотре ответа набора инструментов для веб-разработки DevTools браузера Mozilla Firefox и почтового клиента Thunderbird, позволяющая нарушителю обойти защитный механизм CSP (Content Security Policy)
EPSS