CVE-2016-5261
Mozilla: Integer overflow and memory corruption in WebSocketChannel (MFSA 2016-75, MFSA 2016-86)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.
Desbordamiento de enteros en la clase WebSocketChannel en el subsistema WebSockets en Mozilla Firefox en versiones anteriores a la 48.0 y Firefox ESR en versiones anteriores a la 45.4 permite que los atacantes remotos ejecuten código arbitrario o provoquen una denegación de servicio (corrupción de memoria) mediante paquetes manipulados que desencadenan operaciones de redimensionamiento de búfer incorrectas durante el "buffering".
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-06-03 CVE Reserved
- 2016-08-05 CVE Published
- 2023-11-05 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (13)
URL | Tag | Source |
---|---|---|
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html | X_refsource_confirm | |
http://www.securityfocus.com/bid/92260 | Vdb Entry | |
http://www.securitytracker.com/id/1036508 | Vdb Entry | |
https://www.mozilla.org/security/advisories/mfsa2016-86 | X_refsource_confirm |
URL | Date | SRC |
---|
URL | Date | SRC |
---|