PT-2016-1817 · Mozilla+6 · Firefox Esr+7

Sascha Just

·

Publicado

2016-04-26

·

Atualizado

2024-12-12

·

CVE-2016-2814

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 46.0 Firefox ESR versions 38.x prior to 38.8 Firefox ESR versions 45.x prior to 45.1
Description The issue is related to a heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function within the libstagefright component. This overflow occurs due to mismanagement of the sizes table when handling crafted CENC offsets, allowing remote attackers to execute arbitrary code.
Recommendations For Mozilla Firefox versions prior to 46.0, update to version 46.0 or later. For Firefox ESR versions 38.x prior to 38.8, update to version 38.8 or later. For Firefox ESR versions 45.x prior to 45.1, update to version 45.1 or later.

Correção

RCE

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2016-1433
ALT-PU-2016-1454
BDU:2016-01150
CESA-2016_0695
CVE-2016-2814
DSA-3559-1
MGASA-2016-0158
OPENSUSE-SU-2016_1211-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
RHSA-2016:0695
RHSA-2016_0695
SUSE-SU-2016:1258-1
SUSE-SU-2016:1342-1
SUSE-SU-2016:1374-1
USN-2936-1
USN-2936-3

Produtos afetados

Alt Linux
Centos
Firefox Esr
Firefox
Red Hat
Suse
Ubuntu
Libstagefright