What is CVE-2020-16048?

CVE-2020-16048 is a vulnerability in the Angle graphics library that causes the load functions to read past the end of the user-supplied buffer.

Which software is affected by CVE-2020-16048?

Mozilla Firefox versions up to and excluding 85.0.1 and Mozilla Firefox ESR versions up to and excluding 78.7.1 are affected by CVE-2020-16048.

How severe is CVE-2020-16048?

CVE-2020-16048 has a severity rating of 9 out of 10, indicating a critical vulnerability.

How can I fix CVE-2020-16048?

To fix CVE-2020-16048, users should update to Mozilla Firefox version 85.0.1 or later, or Firefox ESR version 78.7.1 or later.

Where can I find more information about CVE-2020-16048?

More information about CVE-2020-16048 can be found in the Mozilla Bugzilla report (https://bugzilla.mozilla.org/show_bug.cgi?id=1676636) and the Mozilla Security Advisory (https://www.mozilla.org/en-US/security/advisories/mfsa2021-06/).

Vulnerability/
CVE-2020-16048

medium

6.5

CWE

125

5/2/2021

2/11/2021

4/8/2024

CVE-2020-16048

First published: Fri Feb 05 2021(Updated: )

In the Angle graphics library, depth pitch computations did not take into account the block size and simply multiplied the row pitch with the pixel height. This caused the load functions to use a very high depth pitch, reading past the end of the user-supplied buffer.Note: This issue only affected Windows operating systems. Other operating systems are unaffected.

Credit: chrome-cve-admin@google.com

Affected Software	Affected Version	How to fix
Mozilla Firefox	<85.0.1	85.0.1
Mozilla Firefox ESR	<78.7.1	78.7.1
Google Angle

Never miss a vulnerability like this again

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

MFSA2021-06

Peer vulnerabilities

(Found alongside the following vulnerabilities)

CVE-2020-16048

Frequently Asked Questions

What is CVE-2020-16048?
CVE-2020-16048 is a vulnerability in the Angle graphics library that causes the load functions to read past the end of the user-supplied buffer.
Which software is affected by CVE-2020-16048?
Mozilla Firefox versions up to and excluding 85.0.1 and Mozilla Firefox ESR versions up to and excluding 78.7.1 are affected by CVE-2020-16048.
How severe is CVE-2020-16048?
CVE-2020-16048 has a severity rating of 9 out of 10, indicating a critical vulnerability.
How can I fix CVE-2020-16048?
To fix CVE-2020-16048, users should update to Mozilla Firefox version 85.0.1 or later, or Firefox ESR version 78.7.1 or later.
Where can I find more information about CVE-2020-16048?
More information about CVE-2020-16048 can be found in the Mozilla Bugzilla report (https://bugzilla.mozilla.org/show_bug.cgi?id=1676636) and the Mozilla Security Advisory (https://www.mozilla.org/en-US/security/advisories/mfsa2021-06/).

agent/type
agent/first-publish-date
agent/references
agent/severity
agent/weakness
agent/author
agent/description
collector/mozilla-advisory
agent/software-canonical-lookup-request
source/Mozilla
agent/software-canonical-lookup
collector/nvd-index
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/tags
agent/event
agent/trending
vendor/mozilla
canonical/mozilla firefox
canonical/mozilla firefox esr
vendor/google
canonical/google angle

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.