CVE-2016-2809
The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user...
5.5 MediumFix available
The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary files by leveraging certain local file execution.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
1.66%Down 3.3 points since Feb 4, 2022
What each source reports
NVD Score used
The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary files by leveraging certain local file execution.
- Record
CVE-2016-2809- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary files by leveraging certain local file execution.
- Record
CVE-2016-2809- Updated
- 2026-11-02
EUVDEUVD-2016-3882 No score
The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary files by leveraging certain local file execution.
- Record
EUVD-2016-3882- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4qq8-cxv5-977h
The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user...
The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary files by leveraging certain local file execution.
- Record
GHSA-4qq8-cxv5-977h- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxopenSUSE:Tumbleweed |
before 50.1.0-1.1 | 50.1.0-1.1 |
firefox-esropenSUSE:Tumbleweed |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-2809 is a medium vulnerability (CVSS 5.5) in Mozilla Firefox, published April 30, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.66%, the 76th percentile. Fixed in MozillaFirefox 50.1.0-1.1.
References
securitytracker.com/id/1035692
bugzilla.mozilla.org/show_bug.cgi?id=1212939
lists.opensuse.org/opensuse-updates/2016-05/msg00038.html
security.gentoo.org/glsa/201701-15
mozilla.org/security/announce/2016/mfsa2016-40.html
nvd.nist.gov/vuln/detail/CVE-2016-2809
Show 194 moreShow less
github.com/advisories/GHSA-4qq8-cxv5-977h
suse.com/security/cve/CVE-2008-5913
This page doesn't list everything
Left out here: 1,862 references. The JSON record has them.