Arbitrary code execution in Mozilla Firefox - CVE-2016-5275
Published: September 22, 2016 / Updated: September 23, 2016
Vulnerability identifier: #VU610
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2016-5275
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Mozilla
Affected software:
Mozilla Firefox
Mozilla Firefox
Detailed vulnerability description
The vulnerability may lead to arbitrary code execution on the target system.
The weakness exists due to working with empty filters during canvas rendering. A global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions allows attackers to execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
The weakness exists due to working with empty filters during canvas rendering. A global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions allows attackers to execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
How to mitigate CVE-2016-5275
Update to 49.0.