Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-firefox-esr | Aug 30, 2017 | Sep 22, 2016 |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Sep 22, 2016 | |
| Centos_linux | — | centos-upgrade-firefox | Sep 22, 2016 | Sep 22, 2016 |
| Debian | debian-upgrade-firefox-esr | Sep 23, 2016 | Sep 22, 2016 | |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | Nov 14, 2016 | Sep 20, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Oct 30, 2017 | Sep 22, 2016 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-firefox | Nov 30, 2017 | Sep 22, 2016 | |
| Mfsa2016 85 | mozilla-firefox-upgrade-49_0 | Oct 25, 2016 | Sep 22, 2016 | |
| Mfsa2016 86 | mozilla-firefox-esr-upgrade-45_4 | Oct 25, 2016 | Sep 22, 2016 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-45_4 | Oct 25, 2016 | Sep 22, 2016 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-developer-yasm-1-3-0-0-175-3-14-0-2-0oracle-solaris-11-3-upgrade-mail-thunderbird-45-5-1-0-175-3-16-0-2-0oracle-solaris-11-3-upgrade-mail-thunderbird-plugin-thunderbird-lightning-45-5-1-0-175-3-16-0-2-0oracle-solaris-11-3-upgrade-web-browser-firefox-45-4-0-0-175-3-14-0-4-0oracle-solaris-11-3-upgrade-web-data-firefox-bookmarks-45-4-0-0-175-3-14-0-4-0 | May 29, 2017 | Sep 22, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-firefox | Sep 21, 2016 | Sep 20, 2016 |
| Redhat_linux | — | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginfo | Oct 21, 2016 | Sep 21, 2016 |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translationssuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-other | Sep 26, 2016 | Sep 22, 2016 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | Sep 22, 2016 | Sep 22, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub