An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-firefox-esrdebian-upgrade-icedovedebian-upgrade-nss | Nov 17, 2016 | Nov 15, 2016 | |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | Nov 16, 2016 | Nov 16, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-libs-nssgentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Oct 30, 2017 | Jan 19, 2017 | |
| Mfsa2016 89 | mozilla-firefox-upgrade-50_0 | Jul 12, 2018 | Jun 11, 2018 | |
| Mfsa2016 90 | mozilla-firefox-esr-upgrade-45_5 | Nov 16, 2016 | Nov 15, 2016 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-45_5 | Dec 1, 2016 | Nov 18, 2016 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-mail-thunderbird-45-5-1-0-175-3-16-0-2-0oracle-solaris-11-3-upgrade-mail-thunderbird-plugin-thunderbird-lightning-45-5-1-0-175-3-16-0-2-0oracle-solaris-11-3-upgrade-web-browser-firefox-45-5-0-0-175-3-15-0-3-0oracle-solaris-11-3-upgrade-web-browser-firefox-plugin-firefox-java-45-5-0-0-175-3-15-0-3-0oracle-solaris-11-3-upgrade-web-data-firefox-bookmarks-45-5-0-0-175-3-15-0-3-0 | May 29, 2017 | May 29, 2017 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Jun 11, 2018 |
| Suse | — | suse-upgrade-libfreebl3suse-upgrade-libfreebl3-32bitsuse-upgrade-libfreebl3-hmacsuse-upgrade-libfreebl3-hmac-32bitsuse-upgrade-libfreebl3-x86suse-upgrade-libsoftokn3suse-upgrade-libsoftokn3-32bitsuse-upgrade-libsoftokn3-hmacsuse-upgrade-libsoftokn3-hmac-32bitsuse-upgrade-libsoftokn3-x86suse-upgrade-mozilla-nsssuse-upgrade-mozilla-nss-32bitsuse-upgrade-mozilla-nss-certssuse-upgrade-mozilla-nss-certs-32bitsuse-upgrade-mozilla-nss-develsuse-upgrade-mozilla-nss-sysinitsuse-upgrade-mozilla-nss-sysinit-32bitsuse-upgrade-mozilla-nss-toolssuse-upgrade-mozilla-nss-x86suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translationssuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-other | Nov 19, 2016 | Nov 15, 2016 |
| Ubuntu | ubuntu-upgrade-libnss3 | Jan 5, 2017 | Nov 15, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub