CVE-2016-1971 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.6%
top 31.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Firefox
Timeline
PublishedMar 13
Latest updateMay 17

Description

The I420VideoFrame::CreateFrame function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows omits an unspecified status check, which might allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDmozilla/firefox44.0.2

🔴Vulnerability Details

1
GHSA
GHSA-26r2-c5w2-92vj: The I420VideoFrame::CreateFrame function in the WebRTC implementation in Mozilla Firefox before 45↗2022-05-17
▶

📋Vendor Advisories

1
Red Hat
Mozilla: WebRTC and LibVPX vulnerabilities found through code inspection (MFSA 2016-32)↗2016-03-08
▶

💬Community

1
Bugzilla
CVE-2016-1970 CVE-2016-1971 CVE-2016-1972 CVE-2016-1975 CVE-2016-1976 Mozilla: WebRTC and LibVPX vulnerabilities found through code inspection (MFSA 2016-32)↗2016-03-08
▶