PT-2016-1449 · Mozilla+3 · Firefox+3

Jonathan Metzman + 1 · Publicado 2016-03-08 · Atualizado 2024-12-12 · CVE-2016-1968

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 45.0

Description The issue is caused by an integer underflow in the Brotli algorithm implementation. This can be exploited by a remote attacker using specially crafted data compressed with the Brotli algorithm, potentially allowing the execution of arbitrary code or causing a denial of service.

Recommendations For versions prior to 45.0, update to version 45.0 or later to resolve the issue. As a temporary workaround, consider disabling Brotli compression until a patch is available. Restrict access to compressed data to minimize the risk of exploitation.

Correção

RCE

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

ALT-PU-2016-1277

ALT-PU-2016-1454

BDU:2016-00750

CVE-2016-1968

OPENSUSE-SU-2016_0731-1

OPENSUSE-SU-2016_0733-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

USN-2917-1

USN-2917-2

USN-2917-3

Produtos afetados

Alt Linux

Firefox

Suse

Ubuntu

Referências · 2116

• https://suse.com/security/cve/CVE-2023-25728 · Nota
• https://suse.com/security/cve/CVE-2022-31743 · Nota
• https://suse.com/security/cve/CVE-2018-12392 · Nota
• https://suse.com/security/cve/CVE-2024-5698 · Nota
• https://suse.com/security/cve/CVE-2013-1701 · Nota
• https://suse.com/security/cve/CVE-2024-5687 · Nota
• https://suse.com/security/cve/CVE-2022-24713 · Nota
• https://suse.com/security/cve/CVE-2014-8642 · Nota
• https://suse.com/security/cve/CVE-2012-4196 · Nota
• https://suse.com/security/cve/CVE-2015-4516 · Nota
• https://suse.com/security/cve/CVE-2019-11716 · Nota
• https://suse.com/security/cve/CVE-2023-28176 · Nota
• https://suse.com/security/cve/CVE-2021-38494 · Nota
• https://suse.com/security/cve/CVE-2012-1965 · Nota
• https://suse.com/security/cve/CVE-2009-3071 · Nota