SB2016092215 - Arbitrary code execution in Mozilla Firefox

Description

This security bulletin contains information about 1 vulnerability.

1) Arbitrary code execution (CVE-ID: CVE-2016-5272)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability may lead to arbitrary code execution on the target system.
The weakness exists during processing layout with input element. invalid cast in nsImageGeometryMixin(). An invalid cast in nsImageGeometryMixin() can cause a potentially exploitable crash.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Remediation

Install update from vendor's website.

References

• https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
• http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html