Arbitrary code execution in Mozilla Firefox - CVE-2016-5275
Published: September 22, 2016 / Updated: September 23, 2016
Vulnerability identifier: #VU610
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-5275
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability may lead to arbitrary code execution on the target system.
The weakness exists due to working with empty filters during canvas rendering. A global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions allows attackers to execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
The weakness exists due to working with empty filters during canvas rendering. A global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions allows attackers to execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Affected software
Mozilla Firefox
How to mitigate CVE-2016-5275
Update to 49.0.