CVE-2016-5291

Published: Jun 11, 2018Modified: Nov 25, 2025

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Affected (4)

Products: Mozilla: Firefox, Thunderbird · Debian: Debian Linux

2 products

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 45.5.0
Mozilla Firefox	Before 50.0
Mozilla Thunderbird	Before 45.5.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

http://rhn.redhat.com/errata/RHSA-2016-2780.html

Source: security@mozilla.org

Third Party Advisory

http://www.securityfocus.com/bid/94336

Source: security@mozilla.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037298

Source: security@mozilla.org

Third Party AdvisoryVDB Entry

https://bugzilla.mozilla.org/show_bug.cgi?id=1292159

Source: security@mozilla.org

ExploitIssue TrackingVendor Advisory

https://security.gentoo.org/glsa/201701-15

Source: security@mozilla.org

Third Party Advisory

https://www.debian.org/security/2016/dsa-3730

Source: security@mozilla.org

Third Party Advisory

https://www.mozilla.org/security/advisories/mfsa2016-89/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2016-90/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2016-93/

Source: security@mozilla.org

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2016-2780.html