#VU614 Arbitrary code execution in Mozilla Firefox and Oracle Linux - CVE-2016-5272
Published: September 22, 2016 / Updated: January 11, 2017
Vulnerability identifier: #VU614
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2016-5272
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Mozilla Firefox
Oracle Linux
Mozilla Firefox
Oracle Linux
Software vendor:
Mozilla
Oracle
Mozilla
Oracle
Description
The vulnerability may lead to arbitrary code execution on the target system.
The weakness exists during processing layout with input element. invalid cast in nsImageGeometryMixin(). An invalid cast in nsImageGeometryMixin() can cause a potentially exploitable crash.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
The weakness exists during processing layout with input element. invalid cast in nsImageGeometryMixin(). An invalid cast in nsImageGeometryMixin() can cause a potentially exploitable crash.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Remediation
Update to 49.0.