CVE-2016-5291

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-52926.5During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.CVE-2016-52935.5When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitra CVE-2016-52945.5The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vul CVE-2016-52957.8This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke CVE-2016-52967.5A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. T CVE-2016-52979.8An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerabili CVE-2016-52986.5A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when t CVE-2016-52997.5A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Fir CVE-2016-53007.5The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial CVE-2016-53017.5The parse_chunk_header function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted (1) HT CVE-2016-53029.8Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on th CVE-2016-53036.1Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 a