CVE-2016-2796: Buffer Overflow
Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2796?
CVE-2016-2796 has a severity rating of critical due to its potential to allow remote attackers to cause denial of service effects.
How do I fix CVE-2016-2796?
To fix CVE-2016-2796, update Graphite2 to version 1.3.6 or later, and ensure that affected versions of Mozilla Firefox are also updated past 45.0.
Which software is affected by CVE-2016-2796?
CVE-2016-2796 affects Graphite2 versions prior to 1.3.6 and multiple versions of Mozilla Firefox and Firefox ESR prior to 45.0 and 38.7 respectively.
Can CVE-2016-2796 be exploited remotely?
Yes, CVE-2016-2796 can be exploited remotely by attackers sending crafted Graphite data to vulnerable applications.
What type of vulnerability is CVE-2016-2796?
CVE-2016-2796 is classified as a heap-based buffer overflow vulnerability.