Published: 11/06/2018 Updated: 01/08/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox
mozilla firefox esr

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 5, Red HatEnterprise Linux 6, and Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact ofCritical A ...

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or bypass of the same-origin policy Also, a man-in-the-middle attack in the addon update mechanism has been fixed For the stable distribution (jess ...

A flaw was found in the way Add-on update process was handled by Firefox A Man-in-the-Middle attacker could use this flaw to install a malicious signed add-on update ...

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update ...

Mozilla Foundation Security Advisory 2016-89 Security vulnerabilities fixed in Firefox 50 Announced November 15, 2016 Impact critical Products Firefox Fixed in Firefox 50 ...

Mozilla Foundation Security Advisory 2016-90 Security vulnerabilities fixed in Firefox ESR 455 Announced November 15, 2016 Impact critical Products Firefox ESR Fixed in Firefox ESR 455 ...

CWE-295 https://www.mozilla.org/security/advisories/mfsa2016-90/https://www.mozilla.org/security/advisories/mfsa2016-89/https://bugzilla.mozilla.org/show_bug.cgi?id=1303418 https://security.gentoo.org/glsa/201701-15 http://www.securitytracker.com/id/1037298 http://www.securityfocus.com/bid/94336 http://rhn.redhat.com/errata/RHSA-2016-2780.html https://access.redhat.com/errata/RHSA-2016:2780 https://usn.ubuntu.com/3124-1/https://nvd.nist.gov

CVE-2016-9064

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect