CVE-2016-1522 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Thunderbird

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-476 — NULL Pointer Dereference9 documents8 sources
Severity
8.8HIGHNVD
EPSS
2.4%
top 14.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
SIL Graphite2Mozilla ThunderbirdDebian Linux+2 more
Timeline
PublishedFeb 13
Latest updateMay 17

Description

Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDmozilla/firefox13 versions+12
▶Debiansil/graphite2< 1.3.5-1+3
▶NVDsil/graphite21.2.4

Also affects: Debian Linux 7.0, 8.0, Fedora 22, 23

🔴Vulnerability Details

3
GHSA
GHSA-g9c3-vp28-w6w3: Code↗2022-05-17
▶
OSV
CVE-2016-1522: Code↗2016-02-13
▶
CVEList
CVE-2016-1522: Code↗2016-02-13
▶

📋Vendor Advisories

3
Ubuntu
graphite2 vulnerabilities↗2016-02-17
▶
Red Hat
graphite2: Null pointer dereference and out-of-bounds access vulnerabilities↗2016-02-05
▶
Debian
CVE-2016-1522: graphite2 - Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 4...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-1522 graphite2: Null pointer dereference and out-of-bounds access vulnerabilities [fedora-all]↗2016-02-09
▶
Bugzilla
CVE-2016-1522 graphite2: Null pointer dereference and out-of-bounds access vulnerabilities↗2016-02-09
▶
CVE-2016-1522 — Mozilla Thunderbird vulnerability | cvebase