Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/244?format=api",
    "vulnerability_id": "VCID-sw3r-xvra-zue6",
    "summary": "Due to flaws in the process we used to update \"Preloaded Public Key Pinning\" in our releases, the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected.",
    "aliases": [
        {
            "alias": "CVE-2016-5284"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/1947?format=api",
            "purl": "pkg:alpm/archlinux/firefox@49.0-1",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@49.0-1"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/1946?format=api",
            "purl": "pkg:alpm/archlinux/firefox@48.0.2-1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-1uv3-mtcv-kbee"
                },
                {
                    "vulnerability": "VCID-2qdm-5rm5-qfhr"
                },
                {
                    "vulnerability": "VCID-2zw2-v1xp-rfd9"
                },
                {
                    "vulnerability": "VCID-3pdf-xrwk-a7bh"
                },
                {
                    "vulnerability": "VCID-88j3-np4m-p3et"
                },
                {
                    "vulnerability": "VCID-b61f-wfbh-uucm"
                },
                {
                    "vulnerability": "VCID-d6s8-w8mc-wyb4"
                },
                {
                    "vulnerability": "VCID-dt5c-74jk-m3dc"
                },
                {
                    "vulnerability": "VCID-e35v-ppxg-tkd1"
                },
                {
                    "vulnerability": "VCID-ewpd-w8v5-efcf"
                },
                {
                    "vulnerability": "VCID-k9d6-7kmg-rubt"
                },
                {
                    "vulnerability": "VCID-nnkk-gjzm-s3ad"
                },
                {
                    "vulnerability": "VCID-pefk-5d4r-zfgp"
                },
                {
                    "vulnerability": "VCID-r8mm-erch-93gg"
                },
                {
                    "vulnerability": "VCID-sw3r-xvra-zue6"
                },
                {
                    "vulnerability": "VCID-u7w2-v2us-1qaz"
                },
                {
                    "vulnerability": "VCID-vddw-w1vv-hucw"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@48.0.2-1"
        }
    ],
    "references": [
        {
            "reference_url": "https://security.archlinux.org/ASA-201609-22",
            "reference_id": "ASA-201609-22",
            "reference_type": "",
            "scores": [],
            "url": "https://security.archlinux.org/ASA-201609-22"
        },
        {
            "reference_url": "https://security.archlinux.org/AVG-24",
            "reference_id": "AVG-24",
            "reference_type": "",
            "scores": [
                {
                    "value": "Critical",
                    "scoring_system": "archlinux",
                    "scoring_elements": ""
                }
            ],
            "url": "https://security.archlinux.org/AVG-24"
        },
        {
            "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-85",
            "reference_id": "mfsa2016-85",
            "reference_type": "",
            "scores": [
                {
                    "value": "critical",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-85"
        },
        {
            "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-86",
            "reference_id": "mfsa2016-86",
            "reference_type": "",
            "scores": [
                {
                    "value": "critical",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-86"
        },
        {
            "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-88",
            "reference_id": "mfsa2016-88",
            "reference_type": "",
            "scores": [
                {
                    "value": "critical",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2016-88"
        }
    ],
    "weaknesses": [],
    "exploits": [],
    "severity_range_score": "9.0 - 10.0",
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sw3r-xvra-zue6"
}