CVE-2016-5270

Critical

Published: 22/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via mishandled Unicode characters during text conversion.

Risk Assessment

This vulnerability may lead to denial of service, affecting application availability. There is also a risk of unspecified impact on the system, which could compromise data security.

Recommendation

It is recommended to update Mozilla Firefox, Firefox ESR, and Thunderbird to the latest versions to mitigate this vulnerability.

Original NVD description (English source)

Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion.