FKIE_CVE-2016-1522

Vulnerability from fkie_nvd - Published: 2016-02-13 02:59 - Updated: 2026-06-17 00:42
Severity
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.
References
cret@cert.orghttp://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.htmlExploit, Third Party Advisory
cret@cert.orghttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.htmlThird Party Advisory
cret@cert.orghttp://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.htmlThird Party Advisory
cret@cert.orghttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html
cret@cert.orghttp://rhn.redhat.com/errata/RHSA-2016-0197.html
cret@cert.orghttp://rhn.redhat.com/errata/RHSA-2016-0258.html
cret@cert.orghttp://rhn.redhat.com/errata/RHSA-2016-0594.html
cret@cert.orghttp://www.debian.org/security/2016/dsa-3479Third Party Advisory
cret@cert.orghttp://www.mozilla.org/security/announce/2016/mfsa2016-14.htmlVendor Advisory
cret@cert.orghttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
cret@cert.orghttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
cret@cert.orghttp://www.securityfocus.com/bid/82991
cret@cert.orghttp://www.ubuntu.com/usn/USN-2902-1
cret@cert.orghttps://security.gentoo.org/glsa/201701-35
cret@cert.orghttps://security.gentoo.org/glsa/201701-63
af854a3a-2127-422b-91ae-364da2661108http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.htmlExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0197.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0258.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0594.html
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3479Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.mozilla.org/security/announce/2016/mfsa2016-14.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/82991
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2902-1
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201701-35
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201701-63
Impacted products
Vendor Product Version
fedoraproject fedora 22
fedoraproject fedora 23
mozilla firefox 38.0
mozilla firefox 38.0.1
mozilla firefox 38.0.5
mozilla firefox 38.1.0
mozilla firefox 38.1.1
mozilla firefox 38.2.0
mozilla firefox 38.2.1
mozilla firefox 38.3.0
mozilla firefox 38.4.0
mozilla firefox 38.5.0
mozilla firefox 38.5.1
mozilla firefox 38.5.2
mozilla firefox 38.6.0
mozilla thunderbird *
debian debian_linux 7.0
debian debian_linux 8.0
sil graphite2 1.2.4
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cret@cert.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
              "matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
              "matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "35BF0AFB-26BA-4BEA-B6B8-11CF88E951DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F007CC6-9391-4E1C-A747-F3DE5E572FA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "45E9641F-430C-4B3A-BD63-EC13DBD3D1E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5AADD23B-A8AF-4679-990D-C29A1D6EB5CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1343A1FD-98CF-4A6C-A697-1253E538FD5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D098567-B55E-4EAC-8FAA-31FAFDD4058F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE0389BC-D295-4957-8AE7-EDAC770F596D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E75E69A5-AC94-4F35-9EFB-1BFF8B78210D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2765E663-C9CF-476A-B7A8-6F02D0E2D72D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "62B4E871-0ACB-4EC5-8392-EAD0DF25E64B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "435D6EF5-C879-4121-9D47-EF2236E53409",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F99233D-55EE-474D-9D8A-872D5FD9F3DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5963D11-D2F4-40A7-81CE-E034C91FCCBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9835F35-2BFD-40D3-976E-953FB7F21330",
              "versionEndIncluding": "38.5.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sil:graphite2:1.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C989A1ED-6F9A-4868-9B8F-7770780CC055",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font."
    },
    {
      "lang": "es",
      "value": "Code.cpp en Libgraphite en Graphite 2 1.2.4, como se utiliza en Mozilla Firefox en versiones anteriores a 43.0 y Firefox ESR 38.x en versiones anteriores a 38.6.1, no considera las llamadas recursivas de carga durante una comprobaci\u00f3n de tama\u00f1o, lo que permite a atacantes remotos causar una denegaci\u00f3n de servicio (desbordamiento d buffer basado en memoria din\u00e1mica) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de una fuente inteligente Graphite."
    }
  ],
  "id": "CVE-2016-1522",
  "lastModified": "2026-06-17T00:42:06.923",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-02-13T02:59:07.930",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0197.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0258.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0594.html"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.debian.org/security/2016/dsa-3479"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-14.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.securityfocus.com/bid/82991"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.ubuntu.com/usn/USN-2902-1"
    },
    {
      "source": "cret@cert.org",
      "url": "https://security.gentoo.org/glsa/201701-35"
    },
    {
      "source": "cret@cert.org",
      "url": "https://security.gentoo.org/glsa/201701-63"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0197.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0258.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0594.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.debian.org/security/2016/dsa-3479"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-14.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/82991"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2902-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/201701-35"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/201701-63"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.