CVE-2016-5296: Debian Linux

High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days.

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Affected products

• Debian Debian Linux: version 8.0 only
• Mozilla Firefox: before 45.5.0 (fixed in 45.5.0); before 50.0 (fixed in 50.0)
• Mozilla Thunderbird: before 45.5.0 (fixed in 45.5.0)

Published 2018-06-11. Last modified 2026-06-17.