CVE-2016-9904: Infoleak

Published Dec 13, 2016
·
Updated

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites.

Affected Software

20 affected componentsFixes available
debian/firefox
118.0.2-1
debian/firefox-esr
91.12.0esr-1~deb10u1115.3.1esr-1~deb10u1102.15.0esr-1~deb11u1115.3.1esr-1~deb11u1102.15.1esr-1~deb12u1115.3.0esr-1~deb12u1115.3.0esr-1
Mozilla Thunderbird<45.6
45.6
Mozilla Firefox<50.1
50.1
Mozilla Firefox ESR<45.6
45.6
redhat Enterprise Linux Desktop=5.0
redhat Enterprise Linux Desktop=6.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Server=5.0
redhat Enterprise Linux Server=6.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Workstation=5.0
redhat Enterprise Linux Workstation=6.0
redhat Enterprise Linux Workstation=7.0
Debian Debian Linux=8.0
Mozilla Firefox<51.0
Mozilla Firefox ESR<45.6.0
Mozilla Thunderbird<45.6.0
Mozilla Firefox<45.6.0
alpine/firefox-esr<45.6.0
45.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/firefox to a version that resolves this vulnerability.

    Fixed in 118.0.2-1
  2. Upgrade

    Upgrade debian/firefox-esr to a version that resolves this vulnerability.

    Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1
  3. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 45.6
  4. Upgrade

    Upgrade Firefox to a version that resolves this vulnerability.

    Fixed in 50.1
  5. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 45.6
  6. Upgrade

    Upgrade alpine/firefox-esr to a version that resolves this vulnerability.

    Fixed in 45.6.0

Event History

Dec 13, 2016
CVE Published
via Mozilla·12:00 AM
Jun 11, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Data Sourced
via NVD·09:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·09:29 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2016-9904?

The severity of CVE-2016-9904 has been classified as high due to its potential to leak sensitive user information across websites.

2

How do I fix CVE-2016-9904?

To fix CVE-2016-9904, ensure that you are using an updated version of the affected software, such as Firefox 118.0.2-1 or newer.

3

Which software is affected by CVE-2016-9904?

Affected software includes Mozilla Firefox, Firefox ESR, and Thunderbird versions below the specified remedial versions.

4

What kind of attack does CVE-2016-9904 enable?

CVE-2016-9904 enables JavaScript timing attacks that could be exploited to gather sensitive information from users.

5

Can CVE-2016-9904 affect users on multiple websites?

Yes, CVE-2016-9904 can potentially leak information like usernames across different websites by exploiting timing differences.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203