CVE-2016-9893 Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitr...
CriticalCVSS 9.8
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 45.6.0esr-1 | 45.6.0esr-1 |
| debian/firefox-esr(Debian:13) | < 45.6.0esr-1 | 45.6.0esr-1 |
| debian/firefox-esr(Debian:14) | < 45.6.0esr-1 | 45.6.0esr-1 |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux | = 5.0 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| mozilla Thunderbird | < 45.6.0 | 45.6.0 |
| mozilla Firefox | < 50.1 | 50.1 |
| mozilla Firefox | < 45.6.0 | 45.6.0 |
| alpine/firefox-esr(Alpine:v3.4) | < 45.6.0 | 45.6.0 |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla firefox esr | < 45.6 | 45.6 |
| mozilla Thunderbird | < 45.6 | 45.6 |
References
- Debian Security Tracker CVE-2016-9893 vendor-advisory
- RHSA-2016:2946 third-party-advisory vendor-advisory
- RHSA-2016:2973 third-party-advisory vendor-advisory
- 94885 third-party-advisory vdb-entry
- 1037461 third-party-advisory vdb-entry
- bugzilla.mozilla.org issue-tracking vendor-advisory
- GLSA-201701-15 third-party-advisory vendor-advisory
- DSA-3757 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- security.alpinelinux.org vendor-advisory