CVE-2016-5284

Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which…

published September 22, 2016

CVSS
—
EPSS
2%
Percentile
83.6
In the wild
Unconfirmed
What it is

Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02373 · 83.6th percentile
Published
2016-09-22T22:00Z
EPSS history
Timeline
  • 22 SEP 22:00Z
    Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which…
    cvelistv5