#VU1018 Denial of service in Oracle products - CVE-2016-1954

Vulnerability identifier: #VU1018

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2016-1954

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Mozilla Firefox
Firefox ESR
Mozilla Thunderbird
Oracle Solaris
Oracle Linux

Software vendor:
Mozilla
Oracle

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to improper input validation. By convincing a victim to visit a malicious website, attackers can overwrite an add-on resource that may lead to denial of service or privilege escalation.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.

Update Firefox to version 45.
Update Firefox ESR to version 38.7.
Update Thunderbird to version 38.7 or 45.

• https://tools.cisco.com/security/center/viewAlert.x?alertId=43941
• https://www.mozilla.org/en-US/security/advisories/mfsa2016-17/
• http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html