Mozilla

Mozilla

Mozilla Foundation Security Advisory 2009-06

Directives to not cache pages ignored

Announced
February 3, 2009
Reporter
Paul Nel
Impact
Low
Products
Firefox
Fixed in
  • Firefox 3.0.6

Description

Paul Nel reported that certain HTTP directives to not cache web pages, Cache-Control: no-store and Cache-Control: no-cache for HTTPS pages, were being ignored by Firefox 3. On a shared system, applications relying upon these HTTP directives could potentially expose private data. Another user on the system could use this vulnerability to view improperly cached pages containing private data by navigating the browser back.

Firefox 2 releases are not affected.

References