Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2016-5291: Firefox ESR, Thunderbird allow loading any local file
CVE-2016-5291 · published 8 years ago
Summary
A flaw lets specially crafted shortcut files bypass normal security checks and cause Firefox ESR, Firefox, or Thunderbird to read any file on the computer. This can expose sensitive data on systems running those older versions. Upgrade to the latest releases or apply available security updates to resolve the issue.
What to do
- Update debian firefox-esr to version 45.5.0esr-1.
- Update mozilla thunderbird to version 45.5.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 45.5.0esr-1 Fix: upgrade to 45.5.0esr-1
|
| Debian:13 | debian | firefox-esr |
< 45.5.0esr-1 Fix: upgrade to 45.5.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 45.5.0esr-1 Fix: upgrade to 45.5.0esr-1
|
| – | mozilla | firefox |
< 45.5.0 < 50.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | thunderbird |
< 45.5.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
References
- https://security-tracker.debian.org/tracker/CVE-2016-5291 Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2780.html Third Party Advisory
- http://www.securityfocus.com/bid/94336 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1037298 Third Party Advisory VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1292159 Exploit Issue Tracking Vendor Advisory
- https://security.gentoo.org/glsa/201701-15 Third Party Advisory
- https://www.debian.org/security/2016/dsa-3730 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-89/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-90/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-93/ Vendor Advisory
Severity
5.5
Medium
Type
CWE-20Improper Input Validation
Timeline
Published11 Jun 2018
Updated4 Nov 2026
First seen22 Sep 2026
Track software like this
Free during beta