ISOMAN

CVE

CVE-2016-2837

Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.

Severity
MEDIUM
CVSS
6.3
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Oracle Linux7.9 x86_64 server dvdunknownsource
Oracle Linux7.9 x86_64 server bootunknownsource
Oracle Linux7.9 x86_64 server uek-bootunknownsource
Oracle Linux7.9 source source-dvd1unknownsource
Oracle Linux7.9 source source-dvd2unknownsource
Oracle Linux7.8 x86_64 server dvdunknownsource
Oracle Linux7.8 x86_64 server bootunknownsource
Oracle Linux7.8 x86_64 server uek-bootunknownsource
Oracle Linux7.8 source source-dvd1unknownsource
Oracle Linux7.8 source source-dvd2unknownsource
Oracle Linux7.7 x86_64 server dvdunknownsource
Oracle Linux7.7 x86_64 server bootunknownsource
Oracle Linux7.7 x86_64 server uek-bootunknownsource
Oracle Linux7.7 source source-dvd1unknownsource
Oracle Linux7.7 source source-dvd2unknownsource
Oracle Linux6.10 x86_64 server dvdunknownsource
Oracle Linux6.10 x86_64 server bootunknownsource
Oracle Linux6.10 x86_64 server uek-bootunknownsource
Oracle Linux6.10 source source-dvd1unknownsource
Oracle Linux6.10 source source-dvd2unknownsource
Oracle Linux6.9 x86_64 server dvdunknownsource
Oracle Linux6.9 x86_64 server bootunknownsource
Oracle Linux6.9 x86_64 server uek-bootunknownsource
Oracle Linux6.9 source source-dvd1unknownsource
Oracle Linux6.9 source source-dvd2unknownsource
Oracle Linux6.8 x86_64 server dvdunknownsource
Oracle Linux6.8 x86_64 server bootunknownsource
Oracle Linux6.8 x86_64 server uek-bootunknownsource
Oracle Linux6.8 source source-dvd1unknownsource
Oracle Linux6.8 source source-dvd2unknownsource
Oracle Linux7.9 aarch64 server dvdunknownsource
Oracle Linux7.9 aarch64 server uek-bootunknownsource
Oracle Linux7.8 aarch64 server dvdunknownsource
Oracle Linux7.8 aarch64 server uek-bootunknownsource
Oracle Linux7.7 aarch64 server dvdunknownsource
Oracle Linux7.7 aarch64 server uek-bootunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html
  2. http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html
  3. http://rhn.redhat.com/errata/RHSA-2016-1551.html
  4. http://www.debian.org/security/2016/dsa-3640
  5. http://www.mozilla.org/security/announce/2016/mfsa2016-77.html
  6. http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
  7. http://www.securityfocus.com/bid/92258
  8. http://www.securitytracker.com/id/1036508
  9. http://www.ubuntu.com/usn/USN-3044-1
  10. http://www.zerodayinitiative.com/advisories/ZDI-16-673
  11. https://bugzilla.mozilla.org/show_bug.cgi?id=1274637
  12. https://security.gentoo.org/glsa/201701-15
  13. http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html
  14. http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html
  15. http://rhn.redhat.com/errata/RHSA-2016-1551.html
  16. http://www.debian.org/security/2016/dsa-3640
  17. http://www.mozilla.org/security/announce/2016/mfsa2016-77.html
  18. http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
  19. http://www.securityfocus.com/bid/92258
  20. http://www.securitytracker.com/id/1036508