Vulnerability Details : CVE-2016-5297
An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
Vulnerability category: Overflow
Products affected by CVE-2016-5297
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-5297
0.49%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 77 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-5297
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2016-5297
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-5297
-
https://www.mozilla.org/security/advisories/mfsa2016-93/
Security vulnerabilities fixed in Thunderbird 45.5 — MozillaVendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-2780.html
RHSA-2016:2780 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://security.gentoo.org/glsa/201701-15
Mozilla Firefox, Thunderbird: Multiple vulnerabilities (GLSA 201701-15) — Gentoo securityThird Party Advisory
-
https://www.debian.org/security/2016/dsa-3730
Debian -- Security Information -- DSA-3730-1 icedoveThird Party Advisory
-
http://www.securitytracker.com/id/1037298
Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code, Bypass Security Restrictions, Spoof URLs, Modify Files, and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/94336
Mozilla Firefox Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1303678
1303678 - (CVE-2016-5297) Assertion failure: args.length() <= ARGS_LENGTH_MAXIssue Tracking;Vendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2016-90/
Security vulnerabilities fixed in Firefox ESR 45.5 — MozillaVendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2016-89/
Security vulnerabilities fixed in Firefox 50 — MozillaVendor Advisory
Jump to