Denial of service in Oracle products - CVE-2016-1954

Vulnerability identifier: #VU1018

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2016-1954

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Mozilla
Oracle

Affected software:
Mozilla Firefox
Firefox ESR
Mozilla Thunderbird
Oracle Solaris
Oracle Linux

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to improper input validation. By convincing a victim to visit a malicious website, attackers can overwrite an add-on resource that may lead to denial of service or privilege escalation.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.

Update Firefox to version 45.
Update Firefox ESR to version 38.7.
Update Thunderbird to version 38.7 or 45.

• https://tools.cisco.com/security/center/viewAlert.x?alertId=43941
• https://www.mozilla.org/en-US/security/advisories/mfsa2016-17/
• http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html