CVE-2016-5278
published 2016-09-22CVE-2016-5278: Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4…
PriorityP345high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
4.16%
89.6th percentile
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 49.0-1 (sid) | firefox 49.0-1 (sid) |
| debian | firefox-esr | < firefox 49.0-1 (sid) | firefox 49.0-1 (sid) |
| mozilla | firefox | <= 48.0.2 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 49.0+build4-0ubuntu0.14.04.1 | 49.0+build4-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 49.0+build4-0ubuntu0.16.04.1 | 49.0+build4-0ubuntu0.16.04.1 |
| mozilla | thunderbird | >= 0 < 1:45.4.0+build1-0ubuntu0.14.04.1 | 1:45.4.0+build1-0ubuntu0.14.04.1 |
| mozilla | thunderbird | >= 0 < 1:45.4.0+build1-0ubuntu0.16.04.1 | 1:45.4.0+build1-0ubuntu0.16.04.1 |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2016-10-27·CVSS 4.3
CVE-2016-5250 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Catalin Dumitru discovered that URLs of resources loaded after a
navigation start could be leaked to the following page via the Resource
Timing API. If a user were tricked in to opening a specially crafted
website in a browsing context, an attacker could potentially exploit this
to obtain sensitive information. (CVE-2016-5250)
Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard,
Steve Fink, Tyson Smith, and Carsten Book discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary
code. (CVE-2016-5
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2016-09-22·CVSS 6.5
CVE-2016-2827 [MEDIUM] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Atte Kettunen discovered an out-of-bounds read when handling certain
Content Security Policy (CSP) directives in some circumstances. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service via application
crash. (CVE-2016-2827)
Christoph Diehl, Christian Holler, Gary Kwong, Nathan Froyd, Honza Bambas,
Seth Fowler, Michael Smith, Andrew McCreight, Dan Minor, Byron Campen, Jon
Coppeard, Steve Fink, Tyson Smith, and Carsten Book discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could potentially e
Red Hat
Mozilla: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame (MFSA 2016-85, MFSA 2016-86)
vendor_redhat·2016-09-20·CVSS 8.8
CVE-2016-5278 [HIGH] Mozilla: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame (MFSA 2016-85, MFSA 2016-86)
Mozilla: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame (MFSA 2016-85, MFSA 2016-86)
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2016-5278: firefox - Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozill...
vendor_debian·2016·CVSS 8.8
CVE-2016-5278 [HIGH] CVE-2016-5278: firefox - Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozill...
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
Scope: local
sid: resolved (fixed in 49.0-1)
GHSA
GHSA-jf8q-fmcm-x642: Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49
ghsa_unreviewed·2022-05-14
CVE-2016-5278 [HIGH] CWE-119 GHSA-jf8q-fmcm-x642: Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
OSV
thunderbird vulnerabilities
osv·2016-10-27·CVSS 4.3
CVE-2016-5250 [MEDIUM] thunderbird vulnerabilities
thunderbird vulnerabilities
Catalin Dumitru discovered that URLs of resources loaded after a
navigation start could be leaked to the following page via the Resource
Timing API. If a user were tricked in to opening a specially crafted
website in a browsing context, an attacker could potentially exploit this
to obtain sensitive information. (CVE-2016-5250)
Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard,
Steve Fink, Tyson Smith, and Carsten Book discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary
code. (CVE-2016-5257)
Atte Kettunen discovered a heap buffer overflow during text co
OSV
CVE-2016-5278: Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49
osv·2016-09-22·CVSS 8.8
CVE-2016-5278 [HIGH] CVE-2016-5278: Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
OSV
firefox vulnerabilities
osv·2016-09-22·CVSS 6.5
CVE-2016-2827 [MEDIUM] firefox vulnerabilities
firefox vulnerabilities
Atte Kettunen discovered an out-of-bounds read when handling certain
Content Security Policy (CSP) directives in some circumstances. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service via application
crash. (CVE-2016-2827)
Christoph Diehl, Christian Holler, Gary Kwong, Nathan Froyd, Honza Bambas,
Seth Fowler, Michael Smith, Andrew McCreight, Dan Minor, Byron Campen, Jon
Coppeard, Steve Fink, Tyson Smith, and Carsten Book discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary
code. (CVE-2016-5256, CVE-
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2016-1912.htmlhttp://www.debian.org/security/2016/dsa-3674http://www.mozilla.org/security/announce/2016/mfsa2016-85.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://www.securityfocus.com/bid/93049http://www.securitytracker.com/id/1036852https://bugzilla.mozilla.org/show_bug.cgi?id=1294677https://security.gentoo.org/glsa/201701-15https://www.mozilla.org/security/advisories/mfsa2016-86/https://www.mozilla.org/security/advisories/mfsa2016-88/http://rhn.redhat.com/errata/RHSA-2016-1912.htmlhttp://www.debian.org/security/2016/dsa-3674http://www.mozilla.org/security/announce/2016/mfsa2016-85.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://www.securityfocus.com/bid/93049http://www.securitytracker.com/id/1036852https://bugzilla.mozilla.org/show_bug.cgi?id=1294677https://security.gentoo.org/glsa/201701-15https://www.mozilla.org/security/advisories/mfsa2016-86/https://www.mozilla.org/security/advisories/mfsa2016-88/
2016-09-22
Published