Mozilla FoundationMFSA2016-39Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8) — Mozilla
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.031 Low
EPSS
Percentile
91.0%
Mozilla developers fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
| CPE | Name | Operator | Version |
|---|---|---|---|
| firefox | lt | 46 | |
| firefox esr | lt | 38.8 | |
| firefox esr | lt | 45.1 | |
| thunderbird | lt | 38.8 | |
| thunderbird | lt | 45.1 |
References
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2804
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2805
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2806
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2807
bugzilla.mozilla.org/buglist.cgi?bug_id=1240880,1141382,1229855,1155328,1255298,1249183
bugzilla.mozilla.org/buglist.cgi?bug_id=1251922,1212328,1242810,1253099,1254122,1255949,1228882,1256065,1238592,1260439,1231919,1258231,1242668
bugzilla.mozilla.org/buglist.cgi?bug_id=1254164,1254622,1187420,1254876,1252707
bugzilla.mozilla.org/show_bug.cgi?id=1241731
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.031 Low
EPSS
Percentile
91.0%