CVE-2016-5291

Exploit

EPSS 0.04%
Veröffentlicht 11.06.2018 21:29:00
Zuletzt bearbeitet 25.11.2025 17:50:16
Quelle security@mozilla.org
CVE-Watchlists
Login
Unerledigt
Login

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 12

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version < 45.5.0

Mozilla ≫ Firefox Version < 50.0

Mozilla ≫ Thunderbird Version < 45.5.0

Debian ≫ Debian Linux Version8.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.04%	0.094

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	4.9	3.9	6.9	AV:L/AC:L/Au:N/C:C/I:N/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://security.gentoo.org/glsa/201701-15

Third Party Advisory

http://www.securitytracker.com/id/1037298

Third Party Advisory

VDB Entry

https://www.mozilla.org/security/advisories/mfsa2016-89/

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2016-2780.html

Third Party Advisory

https://www.debian.org/security/2016/dsa-3730

Third Party Advisory

https://www.mozilla.org/security/advisories/mfsa2016-90/