CVE-2016-9074: Debian Linux

Medium severity, CVSS 5.9. EPSS: 2.4% chance of exploitation in the next 30 days.

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

Affected products

• Debian Debian Linux: version 8.0 only
• Mozilla Firefox: before 45.5.0 (fixed in 45.5.0); before 50.0 (fixed in 50.0)
• Mozilla Thunderbird: before 45.5.0 (fixed in 45.5.0)

Published 2018-06-11. Last modified 2026-06-17.