CVE-2016-5278
HighSummary
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
Risk Assessment
This vulnerability poses a serious risk to organizations as it allows remote code execution, potentially leading to full control over the user's system.
Recommendation
It is recommended to update Mozilla Firefox to version 49.0 or later and Thunderbird to version 45.4 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Mozilla Firefox, Firefox ESR, Thunderbird
See all- CVE-2016-5284High
Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning. This allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.
- CVE-2016-5272High
The nsImageGeometryMixin class in Mozilla Firefox before version 49.0, Firefox ESR 45.x before version 45.4, and Thunderbird before version 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, allowing remote attackers to execute arbitrary code via a crafted web site.
- CVE-2015-2740High
Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact.
- CVE-2015-2739High
The ArrayBufferBuilder::append function in Mozilla Firefox before version 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which may lead to unspecified impacts.
- CVE-2015-2738High
The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact.
- CVE-2015-2736High
The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, allowing remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2735High
The nsZipArchive.cpp file in Mozilla Firefox before version 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, allowing remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2731High
Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code.
- CVE-2015-2725High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- CVE-2015-2724High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
Original NVD description (English source)
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.