CVE-2016-5272
HighSummary
The nsImageGeometryMixin class in Mozilla Firefox before version 49.0, Firefox ESR 45.x before version 45.4, and Thunderbird before version 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, allowing remote attackers to execute arbitrary code via a crafted web site.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to user security and data.
Recommendation
It is recommended to update Mozilla Firefox and Thunderbird to the latest versions to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Mozilla Firefox, Firefox ESR, Thunderbird
See all- CVE-2016-5284High
Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning. This allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.
- CVE-2016-5278High
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
- CVE-2015-2740High
Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact.
- CVE-2015-2739High
The ArrayBufferBuilder::append function in Mozilla Firefox before version 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which may lead to unspecified impacts.
- CVE-2015-2738High
The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact.
- CVE-2015-2736High
The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, allowing remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2735High
The nsZipArchive.cpp file in Mozilla Firefox before version 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, allowing remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2731High
Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code.
- CVE-2015-2725High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- CVE-2015-2724High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
Original NVD description (English source)
The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site.