CVE-2016-2838

HIGH

Firefox < 48.0 - Remote Code Execution via SVG Directional Content

Title source: llm

Description

Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document.

References (11)

Core 11

Core References

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3640

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3044-1

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2016/mfsa2016-64.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-1551.html

Issue Tracking, Permissions Required x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=1279814

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201701-15

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/92261

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1036508

Scores

CVSS v3 8.8

EPSS 0.0115

EPSS Percentile 78.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (5)

mozilla/firefox 45.1.0

mozilla/firefox 45.1.1

mozilla/firefox 45.2.0

mozilla/firefox 45.3.0

mozilla/firefox < 47.0.1

Published Aug 05, 2016

Tracked Since Feb 18, 2026