Vulnerability Details : CVE-2016-2828
Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool.
Vulnerability category: Memory CorruptionExecute code
Products affected by CVE-2016-2828
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:45.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:45.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-2828
3.37%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-2828
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
References for CVE-2016-2828
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html
[security-announce] openSUSE-SU-2016:1552-1: important: Security update
-
http://www.debian.org/security/2016/dsa-3600
Debian -- Security Information -- DSA-3600-1 firefox-esr
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html
[security-announce] openSUSE-SU-2016:1557-1: important: Security update
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html
[security-announce] SUSE-SU-2016:1691-1: important: Security update for
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
Oracle Linux Bulletin - April 2016
-
http://www.ubuntu.com/usn/USN-2993-1
USN-2993-1: Firefox vulnerabilities | Ubuntu security notices
-
https://access.redhat.com/errata/RHSA-2016:1217
RHSA-2016:1217 - Security Advisory - Red Hat Customer Portal
-
http://www.mozilla.org/security/announce/2016/mfsa2016-56.html
Use-after-free when textures are used in WebGL operations after recycle pool destruction — MozillaVendor Advisory
-
http://www.securityfocus.com/bid/91075
Mozilla Firefox Multiple Security Vulnerabilities
-
http://www.securitytracker.com/id/1036057
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Bypass Security Restrictions, and Obtain Potentially Sensitive Information and Let Local Users Gain Elevated Privileges - Securi
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1223810
Bugzilla.mozilla.org is offline
Jump to