CVE-2016-1522
HighSummary
In the Libgraphite library in Graphite 2 version 1.2.4, used in Mozilla Firefox before version 43.0 and Firefox ESR 38.x before version 38.6.1, recursive load calls are not considered during size checks. This can lead to denial of service (heap-based buffer overflow) or potentially allow arbitrary code execution via a crafted Graphite smart font.
Risk Assessment
Remote attackers can exploit this vulnerability to perform denial of service attacks or execute malicious code, posing a serious security threat to systems using the affected versions of the browser.
Recommendation
It is recommended to update Mozilla Firefox to version 43.0 or later and Firefox ESR to version 38.6.1 or later to mitigate this vulnerability.
Other vulnerabilities in Libgraphite w Graphite 2
Original NVD description (English source)
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.