CVE-2016-9902 — Vulnetix

Try Vulnetix Request Demo

CVE-2016-9902 PUBLISHED

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

EPSS 0.41% · 61.2th percentile

Risk Scores

EPSS Score

0.41%

61.2th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:16.04:LTS	firefox	0, 41.0.2+build2-0ubuntu1, 42.0+build2-0ubuntu1
Ubuntu:14.04:LTS	firefox	36.0.1+build2-0ubuntu0.14.04.1, 36.0.4+build1-0ubuntu0.14.04.1, 37.0+build2-0ubuntu0.14.04.1

Timeline

Dec 13, 2016 CVE Published
Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
May 19, 2022 EPSS Score
Jul 10, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Feb 4, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score
May 19, 2023 EPSS Score
Jul 10, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2016-9902 third-party-advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/ third-party-advisory
https://ubuntu.com/security/notices/USN-3155-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2016-9902 third-party-advisory

Open in Interactive Console →