Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2016-9899: Firefox and Thunderbird can crash or allow remote code execution
CVE-2016-9899 · published 8 years ago
Summary
Versions of Firefox older than 50.1, Firefox ESR older than 45.6, and Thunderbird older than 45.6 have a flaw that could cause the browser or mail client to stop working or let an attacker run code on the system. The issue occurs when web pages manipulate certain events and audio elements. Update to the latest versions of Firefox, Firefox ESR, and Thunderbird to protect your devices.
What to do
- Update debian firefox-esr to version 45.6.0esr-1.
- Update mozilla thunderbird to version 52.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 45.6.0esr-1 Fix: upgrade to 45.6.0esr-1
|
| Debian:13 | debian | firefox-esr |
< 45.6.0esr-1 Fix: upgrade to 45.6.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 45.6.0esr-1 Fix: upgrade to 45.6.0esr-1
|
| – | debian | debian_linux |
9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
5.0 6.0 7.0 cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_desktop |
5.0 6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server |
5.0 6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server_aus |
7.3 7.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server_eus |
7.3 7.4 7.5 cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_workstation |
5.0 6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* |
| – | mozilla | firefox |
>= 52.0, < 52.1.0 < 53.0 < 45.9.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | thunderbird |
< 52.1.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbi...
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
References
- https://security-tracker.debian.org/tracker/CVE-2016-9899 Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2946.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2973.html Third Party Advisory
- http://www.securityfocus.com/bid/94885 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1037461 Third Party Advisory VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1317409 Exploit Issue Tracking Vendor Advisory
- https://security.gentoo.org/glsa/201701-15 Third Party Advisory
- https://www.debian.org/security/2017/dsa-3757 Third Party Advisory
- https://www.exploit-db.com/exploits/41042/ Third Party Advisory VDB Entry
- https://www.mozilla.org/security/advisories/mfsa2016-94/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-95/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-96/ Vendor Advisory
Severity
9.8
Critical
Type
CWE-416Use After Free
Timeline
Published11 Jun 2018
Updated18 Oct 2026
First seen22 Sep 2026
Track software like this
Free during beta