CVE-2016-2837

MEDIUM

Mozilla Firefox < 47.0.1 - Memory Corruption

Title source: rule

Description

Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.

References (12)

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2016-1551.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html

[Vendor Advisory] http://www.mozilla.org/security/announce/2016/mfsa2016-77.html

[Third Party Advisory] http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1036508

[Vendor Advisory] http://www.ubuntu.com/usn/USN-3044-1

[Third Party Advisory] http://www.zerodayinitiative.com/advisories/ZDI-16-673

[Issue Tracking, Permissions Required] https://bugzilla.mozilla.org/show_bug.cgi?id=1274637

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/92258

[Third Party Advisory] http://www.debian.org/security/2016/dsa-3640

[Third Party Advisory] https://security.gentoo.org/glsa/201701-15

Scores

CVSS v3 6.3

EPSS 0.0040

EPSS Percentile 60.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Classification

CWE

CWE-119

Status draft

Affected Products (8)

mozilla/firefox < 47.0.1

mozilla/firefox

mozilla/firefox

mozilla/firefox

mozilla/firefox

oracle/linux

oracle/linux

oracle/linux

Timeline

Published Aug 05, 2016

Tracked Since Feb 18, 2026