CVE-2016-2808 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Firefox

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer11 documents7 sources
Severity
7.5HIGHNVD
OSV8.8
EPSS
0.7%
top 28.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxDebian FirefoxDebian Firefox-esr
Timeline
PublishedApr 30
Latest updateMay 17

Description

The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service (generation-count overflow, out-of-bounds HashMap write access, and application crash) via a crafted web site.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages4 packages

▶Ubuntumozilla/firefox< 46.0+build5-0ubuntu0.14.04.2+3
▶NVDmozilla/firefox45.0.2+16
▶debiandebian/firefox< firefox 46.0-1 (sid)
▶debiandebian/firefox-esr< firefox 46.0-1 (sid)

🔴Vulnerability Details

4
GHSA
GHSA-v2jp-3gq5-h2jm: The watch implementation in the JavaScript engine in Mozilla Firefox before 46↗2022-05-17
▶
OSV
firefox regression↗2016-05-19
▶
OSV
CVE-2016-2808: The watch implementation in the JavaScript engine in Mozilla Firefox before 46↗2016-04-30
▶
OSV
firefox vulnerabilities↗2016-04-27
▶

📋Vendor Advisories

5
Ubuntu
Firefox regression↗2016-05-19
▶
Ubuntu
Oxygen-GTK3 update↗2016-05-02
▶
Ubuntu
Firefox vulnerabilities↗2016-04-27
▶
Red Hat
Mozilla: Write to invalid HashMap entry through JavaScript.watch() (MFSA 2016-47)↗2016-04-26
▶
Debian
CVE-2016-2808: firefox - The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0...↗2016
▶

💬Community

1
Bugzilla
CVE-2016-2808 Mozilla: Write to invalid HashMap entry through JavaScript.watch() (MFSA 2016-47)↗2016-04-25
▶