PT-2016-5232 · Cairo+4 · Cairo+5

Bert Massop · Published 2016-08-03 · Updated 2024-12-12 · CVE-2016-2839

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 48.0 Mozilla Firefox ESR versions 45.x prior to 45.3

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted video. This is due to improper interaction between cairo surface extent calls and libav header allocation in FFmpeg.

Recommendations For Mozilla Firefox versions prior to 48.0, update to version 48.0 or later. For Mozilla Firefox ESR versions 45.x prior to 45.3, update to version 45.3 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-2839

OPENSUSE-SU-2016:2253-1

OPENSUSE-SU-2016:2254-1

OPENSUSE-SU-2016_1964-1

OPENSUSE-SU-2016_2026-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10230-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2016:2061-1

SUSE-SU-2016:2131-1

SUSE-SU-2016:2195-1

USN-3044-1

Affected Products

Ffmpeg

Firefox

Suse

Ubuntu

Cairo

Libav

References · 2143

• http://mozilla.org/security/announce/2016/mfsa2016-65.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2131-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10230-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2016:2254-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3044-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-0718 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5255 · Vendor Advisory
• http://ubuntu.com/usn/USN-3044-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5260 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2836 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5266 · Vendor Advisory