CVE-2016-5284

Published: Sep 22, 2016Modified: May 6, 2026

7.4

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 4.0

Source: NVD

Description

Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.

Affected (7)

Products: Mozilla: Firefox

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 48.0.2
Mozilla Firefox	Version 45.0.1
Mozilla Firefox	Version 45.0.2
Mozilla Firefox	Version 45.0
Mozilla Firefox	Version 45.1.1
Mozilla Firefox	Version 45.2.0
Mozilla Firefox	Version 45.3.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (26)

http://rhn.redhat.com/errata/RHSA-2016-1912.html

Source: security@mozilla.org

http://seclists.org/dailydave/2016/q3/51

Source: security@mozilla.org

Third Party Advisory

http://www.debian.org/security/2016/dsa-3674

Source: security@mozilla.org

http://www.mozilla.org/security/announce/2016/mfsa2016-85.html

Source: security@mozilla.org

Release Notes

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Source: security@mozilla.org

http://www.securityfocus.com/bid/93049

Source: security@mozilla.org

http://www.securitytracker.com/id/1036852

Source: security@mozilla.org

https://blog.mozilla.org/security/2016/09/16/update-on-add-on-pinning-vulnerability/

Source: security@mozilla.org

Third Party AdvisoryVDB Entry

https://bugzilla.mozilla.org/show_bug.cgi?id=1303127

Source: security@mozilla.org

Issue TrackingThird Party AdvisoryVDB Entry

https://hackernoon.com/tor-browser-exposed-anti-privacy-implantation-at-mass-scale-bd68e9eb1e95

Source: security@mozilla.org

Technical Description

https://security.gentoo.org/glsa/201701-15

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2016-86/

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2016-88/

Source: security@mozilla.org

http://rhn.redhat.com/errata/RHSA-2016-1912.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/dailydave/2016/q3/51

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2016/dsa-3674

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mozilla.org/security/announce/2016/mfsa2016-85.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/93049

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1036852

Source: af854a3a-2127-422b-91ae-364da2661108

https://blog.mozilla.org/security/2016/09/16/update-on-add-on-pinning-vulnerability/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://bugzilla.mozilla.org/show_bug.cgi?id=1303127

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party AdvisoryVDB Entry

https://hackernoon.com/tor-browser-exposed-anti-privacy-implantation-at-mass-scale-bd68e9eb1e95

Source: af854a3a-2127-422b-91ae-364da2661108

Technical Description

https://security.gentoo.org/glsa/201701-15

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.mozilla.org/security/advisories/mfsa2016-86/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.mozilla.org/security/advisories/mfsa2016-88/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.