Arbitrary code execution in Mozilla Firefox and Oracle Linux - CVE-2016-5272

Vulnerability identifier: #VU614

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2016-5272

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Mozilla

Oracle

Affected software:
Mozilla Firefox

Oracle Linux

The vulnerability may lead to arbitrary code execution on the target system.
The weakness exists during processing layout with input element. invalid cast in nsImageGeometryMixin(). An invalid cast in nsImageGeometryMixin() can cause a potentially exploitable crash.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Update to 49.0.

• https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
• http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html