CVE-2016-2837: Buffer Overflow
Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-2837?
CVE-2016-2837 is a vulnerability in the ClearKey Content Decryption Module (CDM) in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3, which may allow remote attackers to execute arbitrary code.
What is the severity of CVE-2016-2837?
The severity of CVE-2016-2837 is medium with a CVSS score of 6.3.
How does CVE-2016-2837 affect Mozilla Firefox?
CVE-2016-2837 affects Mozilla Firefox versions before 48.0 and Firefox ESR 45.x before 45.3.
How can I fix CVE-2016-2837 in Mozilla Firefox?
To fix CVE-2016-2837 in Mozilla Firefox, you should update to version 48.0 or later.
Where can I find more information about CVE-2016-2837?
You can find more information about CVE-2016-2837 on the MITRE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2837), the Mozilla security advisories (https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/), and the Bugzilla report (https://bugzilla.mozilla.org/show_bug.cgi?id=1274637).