CVE-2016-5284

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-52857.5A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ss CVE-2016-52879.8A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier th CVE-2016-52885.9Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those page CVE-2016-52899.8Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effo CVE-2016-52909.8Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume CVE-2016-52915.5A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45 CVE-2016-52926.5During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.CVE-2016-52935.5When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitra CVE-2016-52945.5The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vul CVE-2016-52957.8This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke CVE-2016-52967.5A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. T CVE-2016-52979.8An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerabili