PT-2016-1277 · Mozilla+5 · Firefox+8

Yves Younan · Published 2015-06-14 · Updated 2024-10-22 · CVE-2016-1522

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Graphite 2 versions 1.2.4 and earlier Mozilla Firefox versions prior to 43.0 Mozilla Firefox ESR versions 38.x prior to 38.6.1

Description The issue is caused by a heap-based buffer overflow in the Code.cpp function of the Libgraphite component in Graphite 2, which is used in Mozilla Firefox and Thunderbird. This can be exploited by a remote attacker using a specially crafted Graphite smart font, potentially allowing them to cause a denial of service or execute arbitrary code.

Recommendations For Graphite 2 version 1.2.4 and earlier, update to a version later than 1.2.4 to resolve the issue. For Mozilla Firefox versions prior to 43.0, update to version 43.0 or later. For Mozilla Firefox ESR versions 38.x prior to 38.6.1, update to version 38.6.1 or later.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2015-1539

ALT-PU-2016-1101

ALT-PU-2016-1130

ALT-PU-2016-1136

BDU:2016-00574

CESA-2016_0197

CESA-2016_0258

CESA-2016_0594

CVE-2016-1522

DSA-3479-1

MGASA-2016-0077

MGASA-2016-0078

OPENSUSE-SU-2016_0791-1

RHSA-2016:0197

RHSA-2016:0258

RHSA-2016:0594

RHSA-2016_0197

RHSA-2016_0258

RHSA-2016_0594

USN-2902-1

Affected Products

Alt Linux

Centos

Graphite 2

Firefox

Firefox Esr

Red Hat

Suse

Thunderbird

Ubuntu

References · 117

• 🔥 http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html · Exploit
• https://security-tracker.debian.org/tracker/CVE-2016-1522 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2016-03 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1522 · Security Note
• https://ubuntu.com/security/CVE-2016-1523 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-1130 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1935 · Security Note
• http://debian.org/security/2016/dsa-3479 · Vendor Advisory
• http://mozilla.org/security/announce/2016/mfsa2016-14.html · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2016-01 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2016-0594.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1521 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1930 · Security Note
• https://linux.oracle.com/errata/ELSA-2016-0197.html · Vendor Advisory