vulnerability

Gentoo Linux: CVE-2016-9901: Mozilla Firefox, Thunderbird: Multiple vulnerabilities

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

Jan 3, 2017

Added

Oct 30, 2017

Modified

Mar 31, 2026

Description

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Solutions

gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin

References

CVE-2016-9901
https://attackerkb.com/topics/CVE-2016-9901
CWE-20
EUVD-EUVD-2016-10690
GENTOO-201701-15
https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-10690

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report