CVE-2016-2800

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.

References

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html

http://www.debian.org/security/2016/dsa-3510

http://www.debian.org/security/2016/dsa-3515

http://www.debian.org/security/2016/dsa-3520

http://www.mozilla.org/security/announce/2016/mfsa2016-37.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.securityfocus.com/bid/84222

http://www.securitytracker.com/id/1035215

http://www.ubuntu.com/usn/USN-2917-1

http://www.ubuntu.com/usn/USN-2917-2

http://www.ubuntu.com/usn/USN-2917-3

http://www.ubuntu.com/usn/USN-2927-1

http://www.ubuntu.com/usn/USN-2934-1

https://bugzilla.mozilla.org/show_bug.cgi?id=1249338

https://security.gentoo.org/glsa/201605-06

https://security.gentoo.org/glsa/201701-63

Details

Source: MITRE

Published: 2016-03-13

Updated: 2019-12-27

Type: CWE-119

Risk Information

CVSS v2

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 2.8

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to 44.0.2 (inclusive)

cpe:2.3:a:mozilla:firefox_esr:38.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.0.5:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.1.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.1.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.2.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.2.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.3.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.4.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.5.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.5.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.6.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.6.1:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:*

cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*

cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*

Configuration 4

OR

cpe:2.3:a:sil:graphite2:*:*:*:*:*:*:*:* versions up to 1.3.5 (inclusive)

Tenable Plugins

View all (36 total)

IDNameProductFamilySeverity
99765EulerOS 2.0 SP1 : firefox (EulerOS-SA-2016-1002)NessusHuawei Local Security Checks
critical
96749GLSA-201701-63 : Graphite: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
802023Firefox < 45 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
critical
91986openSUSE Security Update : Mozilla Thunderbird (openSUSE-2016-851)NessusSuSE Local Security Checks
high
91985openSUSE Security Update : Mozilla Thunderbird (openSUSE-2016-848)NessusSuSE Local Security Checks
high
91379GLSA-201605-06 : Mozilla Products: Multiple vulnerabilities (Logjam) (SLOTH)NessusGentoo Local Security Checks
critical
90822Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : thunderbird vulnerabilities (USN-2934-1)NessusUbuntu Local Security Checks
high
90598Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : firefox regressions (USN-2917-3)NessusUbuntu Local Security Checks
critical
9207Mozilla Firefox < 45.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
90421Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : firefox regressions (USN-2917-2)NessusUbuntu Local Security Checks
critical
90263SUSE SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2016:0909-1)NessusSuSE Local Security Checks
critical
90240openSUSE Security Update : MozillaThunderbird (openSUSE-2016-402)NessusSuSE Local Security Checks
critical
90170openSUSE Security Update : MozillaThunderbird (openSUSE-2016-395)NessusSuSE Local Security Checks
critical
90065SUSE SLES10 Security Update : MozillaFirefox (SUSE-SU-2016:0820-1)NessusSuSE Local Security Checks
critical
90031Debian DSA-3520-1 : icedove - security updateNessusDebian Local Security Checks
critical
89990SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2016:0777-1)NessusSuSE Local Security Checks
critical
89988Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20160316)NessusScientific Linux Local Security Checks
high
89986RHEL 5 / 6 / 7 : thunderbird (RHSA-2016:0460)NessusRed Hat Local Security Checks
high
89981Oracle Linux 6 / 7 : thunderbird (ELSA-2016-0460)NessusOracle Linux Local Security Checks
high
89971CentOS 5 / 6 / 7 : thunderbird (CESA-2016:0460)NessusCentOS Local Security Checks
high
89930Ubuntu 14.04 LTS / 15.10 : graphite2 vulnerabilities (USN-2927-1)NessusUbuntu Local Security Checks
high
89929SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2016:0727-1)NessusSuSE Local Security Checks
critical
89915openSUSE Security Update : Firefox (openSUSE-2016-334)NessusSuSE Local Security Checks
critical
89913openSUSE Security Update : MozillaFirefox / mozilla-nspr / mozilla-nss (openSUSE-2016-332)NessusSuSE Local Security Checks
critical
89877Debian DSA-3515-1 : graphite2 - security updateNessusDebian Local Security Checks
high
89875Firefox < 45 Multiple VulnerabilitiesNessusWindows
critical
89874Firefox ESR < 38.7 Multiple VulnerabilitiesNessusWindows
critical
89873Firefox < 45 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
89872Firefox ESR < 38.7 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
89826Ubuntu 12.04 LTS / 14.04 / 15.10 : firefox vulnerabilities (USN-2917-1)NessusUbuntu Local Security Checks
critical
89822Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20160309)NessusScientific Linux Local Security Checks
critical
89816Oracle Linux 5 / 6 / 7 : firefox (ELSA-2016-0373)NessusOracle Linux Local Security Checks
critical
89792Debian DSA-3510-1 : iceweasel - security updateNessusDebian Local Security Checks
critical
89774RHEL 5 / 6 / 7 : firefox (RHSA-2016:0373)NessusRed Hat Local Security Checks
critical
89767FreeBSD : graphite2 -- multiple vulnerabilities (adffe823-e692-4921-ae9c-0b825c218372)NessusFreeBSD Local Security Checks
high
89763CentOS 5 / 6 / 7 : firefox (CESA-2016:0373)NessusCentOS Local Security Checks
critical