CVE-2016-9901
9.8
CRITICAL · CVSS 3.0 · EPSS 2.9% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.88% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-06-11 |
| Last modified | 2026-06-17 |
Affected (6)
| Vendor | Product |
|---|---|
| mozilla | firefox |
| redhat | enterprise linux aus |
| redhat | enterprise linux desktop |
| redhat | enterprise linux eus |
| redhat | enterprise linux server |
| redhat | enterprise linux workstation |
References
- http://rhn.redhat.com/errata/RHSA-2016-2946.html
- http://rhn.redhat.com/errata/RHSA-2016-2973.html
- http://www.securityfocus.com/bid/94885
- http://www.securitytracker.com/id/1037461
- https://bugzilla.mozilla.org/show_bug.cgi?id=1320057
- https://security.gentoo.org/glsa/201701-15
- https://www.mozilla.org/security/advisories/mfsa2016-94/
- https://www.mozilla.org/security/advisories/mfsa2016-95/
- http://rhn.redhat.com/errata/RHSA-2016-2946.html
- http://rhn.redhat.com/errata/RHSA-2016-2973.html
- http://www.securityfocus.com/bid/94885
- http://www.securitytracker.com/id/1037461
- https://bugzilla.mozilla.org/show_bug.cgi?id=1320057
- https://security.gentoo.org/glsa/201701-15
- https://www.mozilla.org/security/advisories/mfsa2016-94/
- https://www.mozilla.org/security/advisories/mfsa2016-95/
→ the Explorer · watch your stack · NVD