CVE-2016-9900: High severity Mozilla Thunderbird vulnerability
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Other sources
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of data: URLs. This could allow for cross-domain data leakage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 45.6 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 50.1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 45.6 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 45.6.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-9900?
CVE-2016-9900 has been classified as a moderate severity vulnerability.
How do I fix CVE-2016-9900?
To fix CVE-2016-9900, update Firefox to version 50.1 or later, or update Firefox ESR and Thunderbird to versions 45.6 or later.
What versions of Firefox are affected by CVE-2016-9900?
CVE-2016-9900 affects Firefox versions prior to 50.1.
Which versions of Thunderbird are impacted by CVE-2016-9900?
Thunderbird versions below 45.6 are affected by CVE-2016-9900.
What are the potential consequences of CVE-2016-9900?
CVE-2016-9900 could lead to cross-domain data leakage due to improper handling of external resources in SVG images.