Every CVE Search/ Get API key

CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does...

7.5 HighFix available

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.29%Up 0.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Record
CVE-2016-9902
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-346
Updated
2026-11-02
CVE List No score

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Record
CVE-2016-9902
Updated
2026-11-02
EUVDEUVD-2016-10691 No score

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Record
EUVD-2016-10691
Updated
2026-11-03
GitHub AdvisoriesGHSA-jhx9-2v44-3f39 7.5

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does...

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Record
GHSA-jhx9-2v44-3f39
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-346
Updated
2026-11-02
OSV 7.5

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Record
CVE-2016-9902
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2016-9902 7.5

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Record
DEBIAN-CVE-2016-9902
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 11 moreShow less
OSVRHSA-2016:2946 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2016:2946
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2016:2973 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2016:2973
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-9902 7.5

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Record
UBUNTU-CVE-2016-9902
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVMGASA-2016-0420 No score

Updated firefox packages fix security vulnerabilities

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2016-9893, CVE-2016-9899, CVE-2016-9895, CVE-2016-9897, CVE-2016-9898, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9904, CVE-2016-9905).

Record
MGASA-2016-0420
Updated
2026-11-02
OSVMGASA-2017-0323 No score

Updated iceape packages fix security vulnerabilities

Updated Iceape packages include security fixes from upstream Seamonkey:

Multiple flaws were found in the way Iceape 2.46 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information. (CVE-2016-5287, CVE-2016-5288, CVE-2016-5289, CVE-2016-5290, CVE-2016-5292, CVE-2016-5297, CVE-2016-9064, CVE-2016-9066, CVE-2016-9067, CVE-2016-9068, CVE-2016-9075, CVE-2016-9077, CVE-2016-5291, CVE-2016-9063, CVE-2016-9070, CVE-2016-9071, CVE-2016-9073, CVE-2016-9076, CVE-2016-9078, CVE-2016-9080, CVE-2016-9893, CVE-2016-9894, CVE-2016-9895, CVE-2016-9896, CVE-2016-9897, CVE-2016-9898, CVE-2016-9899, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9903, CVE-2016-9904, CVE-2017-5373, CVE-2017-5374, CVE-2017-5375, CVE-2017-5376, CVE-2017-5377, CVE-2017-5378, CVE-2017-5379, CVE-2017-5380, CVE-2017-5381, CVE-2017-5382, CVE-2017-5383, CVE-2017-5384, CVE-2017-5385, CVE-2017-5386, CVE-2017-5387, CVE-2017-5388, CVE-2017-5389, CVE-2017-5390, CVE-2017-5391, CVE-2017-5393, CVE-2017-5396)

Record
MGASA-2017-0323
Updated
2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score

MozillaFirefox-50.1.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10071-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2016:3210-1 No score

Security update for MozillaFirefox

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues:

  • MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES
  • MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution
  • MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
  • MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
  • MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms
  • MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments
  • MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag
  • MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
  • MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6
  • MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events

Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information.

Also the following bug was fixed:

  • Fix fontconfig issue (bsc#1000751) on 32bit systems as well.
Record
SUSE-SU-2016:3210-1
Updated
2026-11-02
OSVSUSE-SU-2016:3222-1 No score

Security update for MozillaFirefox

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues:

  • MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES
  • MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution
  • MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
  • MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
  • MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms
  • MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments
  • MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag
  • MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
  • MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6
  • MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events

Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information.

Record
SUSE-SU-2016:3222-1
Updated
2026-11-02
OSVSUSE-SU-2016:3223-1 No score

Security update for MozillaFirefox

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues:

  • MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES
  • MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution
  • MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
  • MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
  • MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms
  • MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments
  • MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag
  • MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
  • MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6
  • MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events

Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information.

  • Fix fontconfig issue (bsc#1000751) on 32bit systems as well.
Record
SUSE-SU-2016:3223-1
Updated
2026-11-02
OSVUSN-3155-1 No score

firefox vulnerabilities

Multiple security vulnerabilities were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to conduct cross-site scripting (XSS) attacks, obtain sensitive information, cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9080, CVE-2016-9893, CVE-2016-9894, CVE-2016-9895, CVE-2016-9896, CVE-2016-9897, CVE-2016-9898, CVE-2016-9899, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9903, CVE-2016-9904)

Record
USN-3155-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Debian:12
 before 45.6.0esr-1
45.6.0esr-1
firefox-esr
Debian:13
 before 45.6.0esr-1
45.6.0esr-1
firefox-esr
Debian:14
 before 45.6.0esr-1
45.6.0esr-1
firefox-esr
Debian:7
From an advisory covering 10 CVEs
 before 45.6.0esr-1~deb7u1, plus listed versions
45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1
Show 19 moreShow less
45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u1
45.6.0esr-1~deb7u1
firefox-esr
Debian:8
From an advisory covering 10 CVEs
 before 45.6.0esr-1~deb8u1, plus listed versions
45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1
Show 20 moreShow less
45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-1~deb7u1
45.6.0esr-1~deb8u1
firefox
Mageia:5
From an advisory covering 10 CVEs
 before 45.6.0-1.mga5
45.6.0-1.mga5
firefox-l10n
Mageia:5
From an advisory covering 10 CVEs
 before 45.6.0-1.mga5
45.6.0-1.mga5
iceape
Mageia:5
From an advisory covering 53 CVEs
 before 2.48-1.mga5
2.48-1.mga5
iceape
Mageia:6
From an advisory covering 53 CVEs
 before 2.48-1.mga6
2.48-1.mga6
firefox
Red Hat:enterprise_linux:5::client
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el5_11
0:45.6.0-1.el5_11
Show 60 moreShow less
Affected packages
PackageAffectedFixed
firefox-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el5_11
0:45.6.0-1.el5_11
firefox
Red Hat:enterprise_linux:5::server
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el5_11
0:45.6.0-1.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el5_11
0:45.6.0-1.el5_11
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 10 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
thunderbird
Red Hat:enterprise_linux:5::client
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el5_11
0:45.6.0-1.el5_11
thunderbird-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el5_11
0:45.6.0-1.el5_11
thunderbird
Red Hat:rhel_productivity:5
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el5_11
0:45.6.0-1.el5_11
thunderbird-debuginfo
Red Hat:rhel_productivity:5
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el5_11
0:45.6.0-1.el5_11
thunderbird
Red Hat:enterprise_linux:6::client
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
thunderbird-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
thunderbird
Red Hat:enterprise_linux:6::server
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
thunderbird-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
thunderbird
Red Hat:enterprise_linux:6::workstation
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
thunderbird-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el6_8
0:45.6.0-1.el6_8
thunderbird
Red Hat:enterprise_linux:7::client
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
thunderbird
Red Hat:enterprise_linux:7::server
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
thunderbird
Red Hat:enterprise_linux:7::workstation
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 7 CVEs
 before 0:45.6.0-1.el7_3
0:45.6.0-1.el7_3
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 10 CVEs
 before 45.6.0esr-62.1
45.6.0esr-62.1
MozillaFirefox
SUSE:OpenStack Cloud 5
From an advisory covering 10 CVEs
 before 45.6.0esr-62.1
45.6.0esr-62.1
MozillaFirefox
SUSE:Manager 2.1
From an advisory covering 10 CVEs
 before 45.6.0esr-62.1
45.6.0esr-62.1
MozillaFirefox
SUSE:Manager Proxy 2.1
From an advisory covering 10 CVEs
 before 45.6.0esr-62.1
45.6.0esr-62.1
MozillaFirefox
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 10 CVEs
 before 45.6.0esr-62.1
45.6.0esr-62.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 10 CVEs
 before 45.6.0esr-62.1
45.6.0esr-62.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 10 CVEs
 before 45.6.0esr-62.1
45.6.0esr-62.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 10 CVEs
 before 45.6.0esr-62.1
45.6.0esr-62.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 10 CVEs
 before 45.6.0esr-62.1
45.6.0esr-62.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP1
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP2
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP2
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Server 12-LTSS
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 10 CVEs
 before 45.6.0esr-96.1
45.6.0esr-96.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP2-LTSS
From an advisory covering 10 CVEs
 before 45.6.0esr-66.1
45.6.0esr-66.1
firefox
Ubuntu:14.04:LTS
 before 50.1.0+build2-0ubuntu0.14.04.1, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 42 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.139.0.3+build2-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.440.0.3+build1-0ubuntu0.14.04.141.0+build3-0ubuntu0.14.04.141.0.1+build2-0ubuntu0.14.04.141.0.2+build2-0ubuntu0.14.04.142.0+build2-0ubuntu0.14.04.143.0+build1-0ubuntu0.14.04.143.0.4+build3-0ubuntu0.14.04.144.0+build3-0ubuntu0.14.04.144.0.1+build2-0ubuntu0.14.04.144.0.2+build1-0ubuntu0.14.04.145.0+build2-0ubuntu0.14.04.145.0.1+build1-0ubuntu0.14.04.245.0.2+build1-0ubuntu0.14.04.146.0+build5-0ubuntu0.14.04.246.0.1+build1-0ubuntu0.14.04.347.0+build3-0ubuntu0.14.04.148.0+build2-0ubuntu0.14.04.149.0+build4-0ubuntu0.14.04.149.0.2+build2-0ubuntu0.14.04.150.0+build2-0ubuntu0.14.04.250.0.2+build1-0ubuntu0.14.04.1
50.1.0+build2-0ubuntu0.14.04.1
firefox
Ubuntu:16.04:LTS
 before 50.1.0+build2-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 11 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.1
50.1.0+build2-0ubuntu0.16.04.1
firefox
Ubuntu:14.04:LTS
From an advisory covering 13 CVEs
 before 50.1.0+build2-0ubuntu0.14.04.1, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 42 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.139.0.3+build2-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.440.0.3+build1-0ubuntu0.14.04.141.0+build3-0ubuntu0.14.04.141.0.1+build2-0ubuntu0.14.04.141.0.2+build2-0ubuntu0.14.04.142.0+build2-0ubuntu0.14.04.143.0+build1-0ubuntu0.14.04.143.0.4+build3-0ubuntu0.14.04.144.0+build3-0ubuntu0.14.04.144.0.1+build2-0ubuntu0.14.04.144.0.2+build1-0ubuntu0.14.04.145.0+build2-0ubuntu0.14.04.145.0.1+build1-0ubuntu0.14.04.245.0.2+build1-0ubuntu0.14.04.146.0+build5-0ubuntu0.14.04.246.0.1+build1-0ubuntu0.14.04.347.0+build3-0ubuntu0.14.04.148.0+build2-0ubuntu0.14.04.149.0+build4-0ubuntu0.14.04.149.0.2+build2-0ubuntu0.14.04.150.0+build2-0ubuntu0.14.04.250.0.2+build1-0ubuntu0.14.04.1
50.1.0+build2-0ubuntu0.14.04.1
firefox
Ubuntu:16.04:LTS
From an advisory covering 13 CVEs
 before 50.1.0+build2-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 11 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.1
50.1.0+build2-0ubuntu0.16.04.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 899 CVEs
 before 50.1.0-1.1
50.1.0-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-9902 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published December 13, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.29%, the 70th percentile. Fixed in firefox-esr 45.6.0esr-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,942 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open