Vulnerability Details : CVE-2016-2800

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
Publish Date : 2016-03-13 Last Update Date : 2019-12-27

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	6.8
Confidentiality Impact	Partial (There is considerable informational disclosure.)
Integrity Impact	Partial (Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.)
Availability Impact	Partial (There is reduced performance or interruptions in resource availability.)
Access Complexity	Medium (The access conditions are somewhat specialized. Some preconditions must be satistified to exploit)
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)	Denial Of ServiceOverflow
CWE ID	119

- Related OVAL Definitions

Title	Definition Id	Class	Family
RHSA-2016:0373: firefox security update (Critical)	oval:com.redhat.rhsa:def:20160373		unix
RHSA-2016:0460: thunderbird security update (Important)	oval:com.redhat.rhsa:def:20160460		unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2016-2800

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	Application	Mozilla	Firefox	*	*	*	*	Version Details Vulnerabilities
2	Application	Mozilla	Firefox Esr	38.0	*	*	*	Version Details Vulnerabilities
3	Application	Mozilla	Firefox Esr	38.0.1	*	*	*	Version Details Vulnerabilities
4	Application	Mozilla	Firefox Esr	38.0.5	*	*	*	Version Details Vulnerabilities
5	Application	Mozilla	Firefox Esr	38.1.0	*	*	*	Version Details Vulnerabilities
6	Application	Mozilla	Firefox Esr	38.1.1	*	*	*	Version Details Vulnerabilities
7	Application	Mozilla	Firefox Esr	38.2.0	*	*	*	Version Details Vulnerabilities
8	Application	Mozilla	Firefox Esr	38.2.1	*	*	*	Version Details Vulnerabilities
9	Application	Mozilla	Firefox Esr	38.3.0	*	*	*	Version Details Vulnerabilities
10	Application	Mozilla	Firefox Esr	38.4.0	*	*	*	Version Details Vulnerabilities
11	Application	Mozilla	Firefox Esr	38.5.0	*	*	*	Version Details Vulnerabilities
12	Application	Mozilla	Firefox Esr	38.5.1	*	*	*	Version Details Vulnerabilities
13	Application	Mozilla	Firefox Esr	38.6.0	*	*	*	Version Details Vulnerabilities
14	Application	Mozilla	Firefox Esr	38.6.1	*	*	*	Version Details Vulnerabilities
15	OS	Opensuse	Leap	42.1	*	*	*	Version Details Vulnerabilities
16	OS	Opensuse	Opensuse	13.1	*	*	*	Version Details Vulnerabilities
17	OS	Opensuse	Opensuse	13.2	*	*	*	Version Details Vulnerabilities
18	OS	Oracle	Linux	5.0	*	*	*	Version Details Vulnerabilities
19	OS	Oracle	Linux	6	*	*	*	Version Details Vulnerabilities
20	OS	Oracle	Linux	7	*	*	*	Version Details Vulnerabilities
21	Application	SIL	Graphite2	*	*	*	*	Version Details Vulnerabilities
22	OS	Suse	Linux Enterprise	12.0	*	*	*	Version Details Vulnerabilities