7.4
CVE-2016-5284
- EPSS 2.37%
- Veröffentlicht 22.09.2016 22:59:18
- Zuletzt bearbeitet 06.05.2026 22:30:45
- CVE-Watchlists
- Unerledigt
LoginMozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.37% | 0.816 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.4 | 2.8 | 4 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
https://security.gentoo.org/glsa/201701-15
http://rhn.redhat.com/errata/RHSA-2016-1912.html
http://www.debian.org/security/2016/dsa-3674
https://www.mozilla.org/security/advisories/mfsa2016-86/
https://www.mozilla.org/security/advisories/mfsa2016-88/
http://www.securitytracker.com/id/1036852
http://www.mozilla.org/security/announce/2016/mfsa2016-85.html
http://www.securityfocus.com/bid/93049
http://seclists.org/dailydave/2016/q3/51
https://blog.mozilla.org/security/2016/09/16/update-on-add-on-pinning-vulnerability/
https://bugzilla.mozilla.org/show_bug.cgi?id=1303127
https://hackernoon.com/tor-browser-exposed-anti-privacy-implantation-at-mass-scale-bd68e9eb1e95