CVE-2016-2800
published 2016-03-13CVE-2016-2800: The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows…
PriorityP337high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
2.27%
81.1th percentile
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 45.0-1 (sid) | firefox 45.0-1 (sid) |
| debian | firefox-esr | < firefox 45.0-1 (sid) | firefox 45.0-1 (sid) |
| debian | graphite2 | < firefox 45.0-1 (sid) | firefox 45.0-1 (sid) |
| mozilla | firefox | <= 44.0.2 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 45.0+build2-0ubuntu0.14.04.1 | 45.0+build2-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 45.0.2+build1-0ubuntu0.14.04.1 | 45.0.2+build1-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 45.0.1+build1-0ubuntu0.14.04.2 | 45.0.1+build1-0ubuntu0.14.04.2 |
| mozilla | thunderbird | >= 0 < 1:38.7.2+build1-0ubuntu0.14.04.1 | 1:38.7.2+build1-0ubuntu0.14.04.1 |
| mozilla | thunderbird | >= 0 < 1:38.7.2+build1-0ubuntu0.16.04.1 | 1:38.7.2+build1-0ubuntu0.16.04.1 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
vendor_cisco6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms Shell Bypass Vulnerability
vendor_cisco·2017-04-05·CVSS 6.7
CVE-2016-9196 [MEDIUM] CWE-264 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms Shell Bypass Vulnerability
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms Shell Bypass Vulnerability
A vulnerability in login authentication management in Cisco Aironet 1800, 2800, and 3800 Series Access Point platforms could allow an authenticated, local attacker to gain unrestricted root access to the underlying Linux operating system. The root Linux shell is provided for advanced troubleshooting and should not be available to individual users, even those with root privileges. The attacker must have the root password to exploit this vulnerability.
The vulnerability occurs because of incorrect management of user credentials when the user authenticates to the device. An attacker could exploit this vulnerability by authenticating to the affected device with the root account. An exploit could allow
Cisco
Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers Shell Bypass Vulnerability
vendor_cisco·2017-04-05·CVSS 6.7
CVE-2016-9197 [MEDIUM] CWE-264 Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers Shell Bypass Vulnerability
Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers Shell Bypass Vulnerability
A vulnerability in the CLI command parser of the Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers could allow an authenticated, local attacker to obtain access to the underlying operating system shell with root-level privileges.
The vulnerability is due to incorrect permissions being assigned to configured users on the device. An attacker could exploit this vulnerability by authenticating to the device and issuing certain commands at the CLI. A successful exploit could allow the attacker to access the underlying operating system shell with root access.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.c
Cisco
Cisco Mobility Express 2800 and 3800 802.11 Denial of Service Vulnerability
vendor_cisco·2017-01-18·CVSS 4.3
CVE-2016-9220 [MEDIUM] CWE-399 Cisco Mobility Express 2800 and 3800 802.11 Denial of Service Vulnerability
Cisco Mobility Express 2800 and 3800 802.11 Denial of Service Vulnerability
A vulnerability in 802.11 ingress packet processing of the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause the connection table to be full of invalid connections and be unable to process new incoming requests.
The vulnerability is due to lack of proper error handling when the 802.11 frame is received with an unexpected status code. An attacker could exploit this vulnerability by sending a crafted 802.11 frame to the targeted device. An exploit could allow the attacker to impact the availability of the device due to the connection table being filled with invalid connections.
There are no workarounds that address this vulnerability.
This advisor
Cisco
Cisco Mobility Express 2800 and 3800 Denial of Service Vulnerability
vendor_cisco·2017-01-18·CVSS 4.3
CVE-2016-9221 [MEDIUM] CWE-399 Cisco Mobility Express 2800 and 3800 Denial of Service Vulnerability
Cisco Mobility Express 2800 and 3800 Denial of Service Vulnerability
A vulnerability in 802.11 ingress connection authentication handling for the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause authentication to fail.
The vulnerability is due to improper error handling for 802.11 authentication requests that do not complete. An attacker could exploit this vulnerability by sending a crafted 802.11 frame to the targeted device. An exploit could allow the attacker to impact the availability of the device due to authentication failures.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cis
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms AMPDU Denial of Service Vulnerability
vendor_cisco·2016-08-17·CVSS 6.1
CVE-2016-6361 [MEDIUM] CWE-20 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms AMPDU Denial of Service Vulnerability
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms AMPDU Denial of Service Vulnerability
A vulnerability in the Aggregated MAC Protocol Data Unit (AMPDU) implementation in Cisco Access Point (AP) platforms could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition.
The vulnerability is due to incomplete input validation of the AMPDU packet header. An attacker could exploit this vulnerability by sending a crafted AMPDU packet to the targeted device. An exploit could allow the attacker to cause the device to reload unexpectedly.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/sec
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms 802.11 Protocol Denial of Service Vulnerability
vendor_cisco·2016-08-17·CVSS 6.1
CVE-2016-6363 [MEDIUM] CWE-119 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms 802.11 Protocol Denial of Service Vulnerability
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms 802.11 Protocol Denial of Service Vulnerability
A vulnerability in the 802.11 wireless LAN protocol for Cisco Access Point (AP) platforms could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads.
The vulnerability is due to rate limiting of 802.11 traffic. An attacker could exploit this vulnerability by sending crafted 802.11 traffic to the targeted adjacent device. An exploit could allow the attacker to cause the device to reload unexpectedly.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.co
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms CLI Privilege Escalation Vulnerability
vendor_cisco·2016-08-17·CVSS 6.8
CVE-2016-6362 [MEDIUM] CWE-264 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms CLI Privilege Escalation Vulnerability
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms CLI Privilege Escalation Vulnerability
A vulnerability in command execution from the command line-interface (CLI) of Cisco Access Point (AP) platforms could allow an authenticated, local attacker to perform privilege escalation to root-level privileges.
The vulnerability occurs because user input is not properly sanitized for certain commands at the CLI. An attacker could exploit this vulnerability by authenticating to the affected device, crafting user input parameters for certain commands, and executing the command at the CLI. An exploit could allow the attacker to elevate privileges to the root level.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerab
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms ARP Request Handling Denial of Service Vulnerability
vendor_cisco·2016-06-09·CVSS 6.8
CVE-2016-1419 [MEDIUM] CWE-20 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms ARP Request Handling Denial of Service Vulnerability
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms ARP Request Handling Denial of Service Vulnerability
A vulnerability exists in Cisco Access Point (AP) platforms when processing Address Resolution Protocol (ARP) packets that could allow an unauthenticated, adjacent attacker to inject crafted entries into the ARP table and eventually cause a reload of the affected device.
The vulnerability is due to improper processing of illegal ARP packets. An attacker could exploit this vulnerability by sending crafted ARP packets to be processed by an affected device. An exploit could allow the attacker to inject crafted entries in the ARP table and eventually cause a reload of the device.
Cisco has released software updates that address this vulnerability. Workarounds that address th
Cisco
Cisco Aironet Access Points Command-Line Interpreter Linux Shell Command Injection Vulnerability
vendor_cisco·2016-06-06·CVSS 6.8
CVE-2016-1418 [MEDIUM] CWE-20 Cisco Aironet Access Points Command-Line Interpreter Linux Shell Command Injection Vulnerability
Cisco Aironet Access Points Command-Line Interpreter Linux Shell Command Injection Vulnerability
A vulnerability in the command-line interpreter of Cisco Aironet 1800, 2800, and 3800 Series Access Points could allow an authenticated, local attacker to inject commands in the Linux shell. The commands could be executed with root-level privileges.
The vulnerability is due to improper sanitization of user-supplied input for parameters of command-line interface (CLI) commands. An attacker could exploit this vulnerability by authenticating to the affected device and executing a subset of CLI commands with crafted input for those parameters. A successful exploit could allow the attacker to execute Linux shell commands with root-level privileges on the affected device.
Cisco has released softwa
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2016-04-27·CVSS 8.8
CVE-2016-1950 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the privileges of the user invoking Thunderbird. (CVE-2016-1952)
Nicolas Golubovic discovered that CSP violation reports can be used to
overwrite local files. If a user were tricked in to opening a specially
crafted website in a browsing context with addon signing disabled and
unpacked addons installed, an attacker could potentially exp
Ubuntu
Firefox regressions
vendor_ubuntu·2016-04-19·CVSS 8.8
[HIGH] Firefox regressions
Title: Firefox regressions
Summary: USN-2917-1 introduced several regressions in Firefox.
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
web compatibility regressions.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini,
Ubuntu
Firefox regressions
vendor_ubuntu·2016-04-07·CVSS 8.8
[HIGH] Firefox regressions
Title: Firefox regressions
Summary: USN-2917-1 introduced several regressions in Firefox.
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
regressions that could result in search engine settings being lost, the
list of search providers appearing empty or the location bar breaking
after typing an invalid URL. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian H
Ubuntu
graphite2 vulnerabilities
vendor_ubuntu·2016-03-14
CVE-2016-1977 graphite2 vulnerabilities
Title: graphite2 vulnerabilities
Summary: graphite2 could be made to crash or run programs as your login if it opened
a specially crafted font.
It was discovered that graphite2 incorrectly handled certain malformed
fonts. If a user or automated system were tricked into opening a specially-
crafted font file, a remote attacker could use this issue to cause
graphite2 to crash, resulting in a denial of service, or possibly execute
arbitrary code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart applications
using graphite2, such as LibreOffice, to make all the necessary changes.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2016-03-09·CVSS 8.8
CVE-2016-1950 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could p
Red Hat
graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)
vendor_redhat·2016-03-08·CVSS 8.8
CVE-2016-2792 [HIGH] graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)
graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.
Red Hat
graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)
vendor_redhat·2016-03-08·CVSS 8.8
CVE-2016-2800 [HIGH] graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)
graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
Debian
CVE-2016-2792: firefox - The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as...
vendor_debian·2016·CVSS 8.8
CVE-2016-2792 [HIGH] CVE-2016-2792: firefox - The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as...
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.
Scope: local
sid: resolved (fixed in 45.0-1)
Debian
CVE-2016-2800: firefox - The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as...
vendor_debian·2016·CVSS 8.8
CVE-2016-2800 [HIGH] CVE-2016-2800: firefox - The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as...
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
Scope: local
sid: resolved (fixed in 45.0-1)
Cisco
Cisco Mobility Express 2800 and 3800 Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2016-9221 Cisco Mobility Express 2800 and 3800 Denial of Service Vulnerability
CVE-2016-9221: Cisco Mobility Express 2800 and 3800 Denial of Service Vulnerability
A vulnerability in 802.11 ingress connection authentication handling for the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause authentication to fail. The vulnerability is due to improper error handling for 802.11 authentication requests that do not complete. An attacker could exploit this vulnerability by sending a crafted 802.11 frame to the targeted device. An exploit could allow the attacker to impact the availability of the device due to authentication failures. There are no
CVSS: 3.0
CWE: CWE-399, CWE-399
Bug IDs: CSCvb33575
Cisco
Cisco Aironet Access Points Command-Line Interpreter Linux Shell Command Injection Vulnerability
vendor_cisco
CVE-2016-1418 Cisco Aironet Access Points Command-Line Interpreter Linux Shell Command Injection Vulnerability
CVE-2016-1418: Cisco Aironet Access Points Command-Line Interpreter Linux Shell Command Injection Vulnerability
A vulnerability in the command-line interpreter of Cisco Aironet 1800, 2800, and 3800 Series Access Points could allow an authenticated, local attacker to inject commands in the Linux shell. The commands could be executed with root -level privileges. The vulnerability is due to improper sanitization of user-supplied input for parameters of command-line interface (CLI) commands. An attacker could exploit this vulnerability by authenticating to the affected device and executing a subset of CLI commands with crafted input for those parameters. A successful exploit could allow the attacker to execute Linux shell commands with root -level privileges on the affected device. Cisco has r
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms 802.11 Protocol Denial of Service Vulnerability
vendor_cisco
CVE-2016-6363 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms 802.11 Protocol Denial of Service Vulnerability
CVE-2016-6363: Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms 802.11 Protocol Denial of Service Vulnerability
A vulnerability in the 802.11 wireless LAN protocol for Cisco Access Point (AP) platforms could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. The vulnerability is due to rate limiting of 802.11 traffic. An attacker could exploit this vulnerability by sending crafted 802.11 traffic to the targeted adjacent device. An exploit could allow the attacker to cause the device to reload unexpectedly. Cisco has released software updates that address this vulnerability. There are no
CWE: CWE-119, CWE-119
Bug IDs: CSCva06192
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms ARP Request Handling Denial of Service Vulnerability
vendor_cisco
CVE-2016-1419 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms ARP Request Handling Denial of Service Vulnerability
CVE-2016-1419: Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms ARP Request Handling Denial of Service Vulnerability
A vulnerability exists in Cisco Access Point (AP) platforms when processing Address Resolution Protocol (ARP) packets that could allow an unauthenticated, adjacent attacker to inject crafted entries into the ARP table and eventually cause a reload of the affected device. The vulnerability is due to improper processing of illegal ARP packets. An attacker could exploit this vulnerability by sending crafted ARP packets to be processed by an affected device. An exploit could allow the attacker to inject crafted entries in the ARP table and eventually cause a reload of the device. Cisco has released software updates that address this vulnerability.
CWE: CWE-20, CW
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms CLI Privilege Escalation Vulnerability
vendor_cisco
CVE-2016-6362 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms CLI Privilege Escalation Vulnerability
CVE-2016-6362: Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms CLI Privilege Escalation Vulnerability
A vulnerability in command execution from the command line-interface (CLI) of Cisco Access Point (AP) platforms could allow an authenticated, local attacker to perform privilege escalation to root -level privileges. The vulnerability occurs because user input is not properly sanitized for certain commands at the CLI. An attacker could exploit this vulnerability by authenticating to the affected device, crafting user input parameters for certain commands, and executing the command at the CLI. An exploit could allow the attacker to elevate privileges to the root level. Cisco has released software updates that address this vulnerability. There are no
CWE: CWE-264, CWE-264
Bug
Cisco
Cisco Mobility Express 2800 and 3800 802.11 Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2016-9220 Cisco Mobility Express 2800 and 3800 802.11 Denial of Service Vulnerability
CVE-2016-9220: Cisco Mobility Express 2800 and 3800 802.11 Denial of Service Vulnerability
A vulnerability in 802.11 ingress packet processing of the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause the connection table to be full of invalid connections and be unable to process new incoming requests. The vulnerability is due to lack of proper error handling when the 802.11 frame is received with an unexpected status code. An attacker could exploit this vulnerability by sending a crafted 802.11 frame to the targeted device. An exploit could allow the attacker to impact the availability of the device due to the connection table being filled with invalid connections. There are no
CVSS: 3.0
CWE: CWE-399, CWE-399
Bug IDs: CSCvb6
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms AMPDU Denial of Service Vulnerability
vendor_cisco
CVE-2016-6361 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms AMPDU Denial of Service Vulnerability
CVE-2016-6361: Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms AMPDU Denial of Service Vulnerability
A vulnerability in the Aggregated MAC Protocol Data Unit (AMPDU) implementation in Cisco Access Point (AP) platforms could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of the AMPDU packet header. An attacker could exploit this vulnerability by sending a crafted AMPDU packet to the targeted device. An exploit could allow the attacker to cause the device to reload unexpectedly. Cisco has released software updates that address this vulnerability. There are no
CWE: CWE-20, CWE-20
Bug IDs: CSCuz56288
Cisco
Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers Shell Bypass Vulnerability
vendor_cisco·CVSS 3.0
CVE-2016-9197 Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers Shell Bypass Vulnerability
CVE-2016-9197: Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers Shell Bypass Vulnerability
A vulnerability in the CLI command parser of the Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers could allow an authenticated, local attacker to obtain access to the underlying operating system shell with root -level privileges. The vulnerability is due to incorrect permissions being assigned to configured users on the device. An attacker could exploit this vulnerability by authenticating to the device and issuing certain commands at the CLI. A successful exploit could allow the attacker to access the underlying operating system shell with root access. There are no
CVSS: 3.0
CWE: CWE-264, CWE-264
Bug IDs: CSCvb70351
Cisco
Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms Shell Bypass Vulnerability
vendor_cisco·CVSS 3.0
CVE-2016-9196 Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms Shell Bypass Vulnerability
CVE-2016-9196: Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms Shell Bypass Vulnerability
A vulnerability in login authentication management in Cisco Aironet 1800, 2800, and 3800 Series Access Point platforms could allow an authenticated, local attacker to gain unrestricted root access to the underlying Linux operating system. The root Linux shell is provided for advanced troubleshooting and should not be available to individual users, even those with root privileges. The attacker must have the root password to exploit this vulnerability. The vulnerability occurs because of incorrect management of user credentials when the user authenticates to the device. An attacker could exploit this vulnerability by authenticating to the affected device with the root account. An exploi
GHSA
GHSA-96h6-mp65-6p2p: The graphite2::Slot::getAttr function in Slot
ghsa_unreviewed·2022-05-13·CVSS 8.8
CVE-2016-2800 [HIGH] CWE-119 GHSA-96h6-mp65-6p2p: The graphite2::Slot::getAttr function in Slot
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
GHSA
GHSA-gp94-h5cv-4hh6: The graphite2::Slot::getAttr function in Slot
ghsa_unreviewed·2022-05-13·CVSS 8.8
CVE-2016-2792 [HIGH] CWE-119 GHSA-gp94-h5cv-4hh6: The graphite2::Slot::getAttr function in Slot
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.
OSV
thunderbird vulnerabilities
osv·2016-04-27·CVSS 8.8
CVE-2016-1952 [HIGH] thunderbird vulnerabilities
thunderbird vulnerabilities
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the privileges of the user invoking Thunderbird. (CVE-2016-1952)
Nicolas Golubovic discovered that CSP violation reports can be used to
overwrite local files. If a user were tricked in to opening a specially
crafted website in a browsing context with addon signing disabled and
unpacked addons installed, an attacker could potentially exploit this to
gain additional privileges. (CVE-2016-1954)
Jose Marti
OSV
firefox regressions
osv·2016-04-19·CVSS 8.8
[HIGH] firefox regressions
firefox regressions
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
web compatibility regressions.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple
memory safety issues in Firefox.
OSV
firefox regressions
osv·2016-04-07·CVSS 8.8
[HIGH] firefox regressions
firefox regressions
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
regressions that could result in search engine settings being lost, the
list of search providers appearing empty or the location bar breaking
after typing an invalid URL. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup,
OSV
CVE-2016-2800: The graphite2::Slot::getAttr function in Slot
osv·2016-03-13·CVSS 8.8
CVE-2016-2800 [HIGH] CVE-2016-2800: The graphite2::Slot::getAttr function in Slot
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
OSV
CVE-2016-2792: The graphite2::Slot::getAttr function in Slot
osv·2016-03-13·CVSS 8.8
CVE-2016-2792 [HIGH] CVE-2016-2792: The graphite2::Slot::getAttr function in Slot
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.
OSV
firefox vulnerabilities
osv·2016-03-09·CVSS 8.8
CVE-2016-1950 [HIGH] firefox vulnerabilities
firefox vulnerabilities
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.htmlhttp://www.debian.org/security/2016/dsa-3510http://www.debian.org/security/2016/dsa-3515http://www.debian.org/security/2016/dsa-3520http://www.mozilla.org/security/announce/2016/mfsa2016-37.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/84222http://www.securitytracker.com/id/1035215http://www.ubuntu.com/usn/USN-2917-1http://www.ubuntu.com/usn/USN-2917-2http://www.ubuntu.com/usn/USN-2917-3http://www.ubuntu.com/usn/USN-2927-1http://www.ubuntu.com/usn/USN-2934-1https://bugzilla.mozilla.org/show_bug.cgi?id=1249338https://security.gentoo.org/glsa/201605-06https://security.gentoo.org/glsa/201701-63http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.htmlhttp://www.debian.org/security/2016/dsa-3510http://www.debian.org/security/2016/dsa-3515http://www.debian.org/security/2016/dsa-3520http://www.mozilla.org/security/announce/2016/mfsa2016-37.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/84222http://www.securitytracker.com/id/1035215http://www.ubuntu.com/usn/USN-2917-1http://www.ubuntu.com/usn/USN-2917-2http://www.ubuntu.com/usn/USN-2917-3http://www.ubuntu.com/usn/USN-2927-1http://www.ubuntu.com/usn/USN-2934-1https://bugzilla.mozilla.org/show_bug.cgi?id=1249338https://security.gentoo.org/glsa/201605-06https://security.gentoo.org/glsa/201701-63
2016-03-13
Published