SB2016031301 - Denial of service in Mozilla Firefox

Description

This security bulletin contains information about 1 vulnerability.

1) Denial of service (CVE-ID: CVE-2016-1954)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to improper input validation. By convincing a victim to visit a malicious website, attackers can overwrite an add-on resource that may lead to denial of service or privilege escalation.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.

Remediation

Install update from vendor's website.

References

• https://tools.cisco.com/security/center/viewAlert.x?alertId=43941
• https://www.mozilla.org/en-US/security/advisories/mfsa2016-17/
• http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html