vulnerability
MFSA2016-88 Thunderbird: Security vulnerabilities fixed in Thunderbird 45.4 (CVE-2016-5284)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:N/C:P/I:N/A:N) | Sep 22, 2016 | Oct 25, 2016 | Aug 12, 2025 |
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
Published
Sep 22, 2016
Added
Oct 25, 2016
Modified
Aug 12, 2025
Description
Due to flaws in the process we used to update "Preloaded Public Key Pinning" in our releases, the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected.
Solution
mozilla-thunderbird-upgrade-45_4
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.