CVE-2016-5261: Integer Overflow
An integer overflow error in WebSockets during data buffering on incoming packets resulting in attacker controlled data being written at a known offset in the allocated buffer.
Other sources
Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.
— Launchpad
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2016-5261?
CVE-2016-5261 is an integer overflow error in WebSockets during data buffering on incoming packets resulting in arbitrary code execution or denial of service in Mozilla Firefox before version 48.0 and Firefox ESR before version 45.4.
How does CVE-2016-5261 affect Firefox?
CVE-2016-5261 affects Mozilla Firefox versions before 48.0 and Firefox ESR versions before 45.4, allowing remote attackers to execute arbitrary code or cause a denial of service through crafted packets.
What is the severity of CVE-2016-5261?
CVE-2016-5261 has a severity rating of 8.8 (High).
How can I fix CVE-2016-5261 in Mozilla Firefox?
To fix CVE-2016-5261 in Mozilla Firefox, update to version 48.0 or later for regular Firefox, or version 45.4 or later for Firefox ESR.
Where can I find more information about CVE-2016-5261?
You can find more information about CVE-2016-5261 in the following references: [Link 1](https://bugzilla.mozilla.org/show_bug.cgi?id=1287266), [Link 2](https://www.mozilla.org/en-US/security/advisories/mfsa2016-86/), [Link 3](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5261).