CVE-2016-5278: Buffer Overflow
A potentially exploitable crash caused by a buffer overflow while encoding image frames to images
Other sources
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
— Launchpad
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2016-5278.
What is the severity of CVE-2016-5278?
The severity of CVE-2016-5278 is critical with a severity value of 8.8.
Which software versions are affected by CVE-2016-5278?
Mozilla Firefox before version 49.0, Firefox ESR 45.x before version 45.4, and Thunderbird < 45.4 are affected by CVE-2016-5278.
How can remote attackers exploit CVE-2016-5278?
Remote attackers can exploit CVE-2016-5278 by sending crafted image data that is mishandled during the encoding of an image frame to an image, leading to a potentially exploitable crash caused by a buffer overflow.
How do I fix CVE-2016-5278?
To fix CVE-2016-5278, it is recommended to update Mozilla Firefox to version 49.0 or later, Firefox ESR to version 45.4 or later, or Thunderbird to version 45.4 or later.