Skip to content
OpenAdvisories
Unscored CVE-2016-9893 EUVD-2016-10682GHSA-c8hw-wjgm-chwm

Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enou…

Published Jun 11, 2018 · Updated Aug 6, 2024 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Product: Firefox ESR Product: Thunderbird Package: firefox Package: firefox-esr Package: firefox-esr Package: thunderbird Category: Browsers Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Affected products

VendorProductAffectedFixed
Mozilla Firefox unspecified – < 50.1 50.1
Mozilla Firefox ESR unspecified – < 45.6 45.6
Mozilla Thunderbird unspecified – < 45.6 45.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 firefox-esr 45.6.0esr-1 —
Debian 13 firefox-esr 45.6.0esr-1 —
Debian 12 firefox-esr 45.6.0esr-1 —
Debian 8 firefox-esr 45.6.0esr-1~deb8u1 DSA-3734-1
Debian 8 icedove 1:45.6.0-1~deb8u1 DSA-3757-1
Debian 7 firefox-esr 45.6.0esr-1~deb7u1 DLA-743-1
Debian 7 icedove 1:45.6.0-2~deb7u1 DLA-782-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS firefox 50.1.0+build2-0ubuntu0.16.04.1 USN-3155-1
Ubuntu 16.04 LTS thunderbird 1:45.7.0+build1-0ubuntu0.16.04.1 USN-3165-1
Ubuntu 14.04 LTS firefox 50.1.0+build2-0ubuntu0.14.04.1 USN-3155-1
Ubuntu 14.04 LTS thunderbird 1:45.7.0+build1-0ubuntu0.14.04.1 USN-3165-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 firefox +1 45.6.0-1.el7_3 RHSA-2016:2973, RHSA-2016:2946
RHEL 6 firefox +1 45.6.0-1.el6_8 RHSA-2016:2973, RHSA-2016:2946
RHEL 5 firefox +1 45.6.0-1.el5_11 RHSA-2016:2973, RHSA-2016:2946
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Productivity 5 thunderbird 45.6.0-1.el5_11 RHSA-2016:2973

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP2 MozillaFirefox 45.6.0esr-96.1 SUSE-SU-2016:3222-1
SLES 12 SP1 MozillaFirefox 45.6.0esr-96.1 SUSE-SU-2016:3222-1
SLES 12 MozillaFirefox 45.6.0esr-96.1 SUSE-SU-2016:3222-1
SLES 11 SP4 MozillaFirefox 45.6.0esr-62.1 SUSE-SU-2016:3210-1
SLES 11 SP3 MozillaFirefox 45.6.0esr-62.1 SUSE-SU-2016:3210-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 11 SP2 MozillaFirefox 45.6.0esr-66.1 SUSE-SU-2016:3223-1
SLES for SAP 12 SP2 MozillaFirefox 45.6.0esr-96.1 SUSE-SU-2016:3222-1
SLES for SAP 12 SP1 MozillaFirefox 45.6.0esr-96.1 SUSE-SU-2016:3222-1
SLES for SAP 12 MozillaFirefox 45.6.0esr-96.1 SUSE-SU-2016:3222-1
SLES for SAP 11 SP4 MozillaFirefox 45.6.0esr-62.1 SUSE-SU-2016:3210-1
SUSE Package Hub 12 MozillaThunderbird 45.6.0-20.1 openSUSE-SU-2016:3308-1, openSUSE-SU-2016:3307-1
SUSE OpenStack Cloud 5 MozillaFirefox 45.6.0esr-62.1 SUSE-SU-2016:3210-1
SUSE Manager Proxy 2.1 MozillaFirefox 45.6.0esr-62.1 SUSE-SU-2016:3210-1
SUSE Manager 2.1 MozillaFirefox 45.6.0esr-62.1 SUSE-SU-2016:3210-1
SUSE Linux Enterprise Point of Sale 11 SP3 MozillaFirefox 45.6.0esr-62.1 SUSE-SU-2016:3210-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 50.1.0-1.1 openSUSE-SU-2024:10071-1
openSUSE Tumbleweed MozillaThunderbird 91.1.1-1.1 openSUSE-SU-2024:10601-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.4 firefox-esr 45.6.0 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 firefox +1 45.6.0-1.0.1.el7_3 ELSA-2016-2973, ELSA-2016-2946

Advisories 18

References