PT-2016-1449 · Mozilla+3 · Firefox+3

Jonathan Metzman + 1 · Published 2016-03-08 · Updated 2024-12-12 · CVE-2016-1968

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 45.0

Description The issue is caused by an integer underflow in the Brotli algorithm implementation. This can be exploited by a remote attacker using specially crafted data compressed with the Brotli algorithm, potentially allowing the execution of arbitrary code or causing a denial of service.

Recommendations For versions prior to 45.0, update to version 45.0 or later to resolve the issue. As a temporary workaround, consider disabling Brotli compression until a patch is available. Restrict access to compressed data to minimize the risk of exploitation.

Fix

RCE

DoS

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2016-1277

ALT-PU-2016-1454

BDU:2016-00750

CVE-2016-1968

OPENSUSE-SU-2016_0731-1

OPENSUSE-SU-2016_0733-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

USN-2917-1

USN-2917-2

USN-2917-3

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 2116

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2800 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1958 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2798 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2799 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1968 · Vendor Advisory
• https://security.gentoo.org/glsa/201605-06 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1968 · Vendor Advisory
• http://ubuntu.com/usn/USN-2917-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-1968 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1959 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1961 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2793 · Vendor Advisory