Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Firefox ESR 45.x may run attacker code from web page

CVE-2016-5272 · published 10 years ago
Summary

Versions of Firefox ESR for Debian older than 45.4 (and standard Firefox releases before version 49) contain a flaw that can let a malicious web page run code on your computer. This could allow an attacker to take control of the browser or the system. Update Firefox ESR to version 45.4 or later (or switch to a newer supported Firefox) as soon as possible; if you cannot update, avoid untrusted sites or use a different browser.

What to do
  • Update debian firefox-esr to version 45.4.0esr-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian firefox-esr < 45.4.0esr-1
Fix: upgrade to 45.4.0esr-1
Debian:13 debian firefox-esr < 45.4.0esr-1
Fix: upgrade to 45.4.0esr-1
Debian:14 debian firefox-esr < 45.4.0esr-1
Fix: upgrade to 45.4.0esr-1
– mozilla firefox <= 48.0.2
45.1.0
45.1.1
45.2.0
45.3.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Original advisory text
The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of IN...
The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site.
References
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published22 Sep 2016
Updated29 Oct 2026
First seen22 Sep 2026
Sources
DEBIAN-CVE-2016-5272 · OSV
CVE-2016-5272 · NVD
Track software like this
Free during beta