CVE-2016-9905: High severity Mozilla Thunderbird vulnerability
A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6.
Other sources
A potentially exploitable crash in EnumerateSubDocuments while adding or removing sub-documents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 45.6 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 45.6 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 45.6.0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-9905?
CVE-2016-9905 has been classified as a potentially exploitable crash vulnerability affecting various versions of Firefox and Thunderbird.
How do I fix CVE-2016-9905?
To mitigate CVE-2016-9905, users should upgrade to Firefox ESR version 45.6 or higher and Thunderbird version 45.6 or higher.
Which products are affected by CVE-2016-9905?
CVE-2016-9905 affects Firefox ESR versions below 45.6 and Thunderbird versions below 45.6.
Can CVE-2016-9905 lead to remote code execution?
While CVE-2016-9905 is primarily a crash vulnerability, it could potentially be exploited to execute arbitrary code in certain scenarios.
When was CVE-2016-9905 publicly disclosed?
CVE-2016-9905 was publicly disclosed as part of a security advisory by Mozilla in 2016.