RHSA-2016:0373
Vulnerability from csaf_opensuse - Published: 2016-03-09 00:00 - Updated: 2026-09-20 10:56Summary
security update for firefox
Severity
Critical
Notes
Title of the patch: security update for firefox
Description of the patch: This security update provides a functional equivalent of RHSA-2016:0373.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2016:0373.
Patchnames: RHSA-2016:0373
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.8 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
8.8 (High)
Affected products
Recommended
2 products, the same list as for
CVE-2016-1952
Threats
Impact
important
References
88 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for firefox",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2016:0373.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2016:0373.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2016:0373",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2016_0373.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1952 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1952/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1954 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1954/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1957 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1957/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1958 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1958/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1960 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1960/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1961 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1961/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1962 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1962/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1964 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1964/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1965 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1965/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1966 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1966/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1973 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1973/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1974 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1974/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1977 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1977/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2790 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2790/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2791 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2791/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2792 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2792/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2793 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2793/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2794 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2794/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2795 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2795/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2796 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2796/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2797 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2797/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2798 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2798/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2799 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2799/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2800 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2800/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2801 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2801/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2802 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2802/"
}
],
"title": "security update for firefox",
"tracking": {
"current_release_date": "2026-09-20T10:56:29Z",
"generator": {
"date": "2016-03-09T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2016:0373",
"initial_release_date": "2016-03-09T00:00:00Z",
"revision_history": [
{
"date": "2016-03-09T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T10:56:29Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:38.7.0-1.el7_2.i686",
"product": {
"name": "firefox-0:38.7.0-1.el7_2.i686",
"product_id": "firefox-0:38.7.0-1.el7_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/suse/firefox@38.7.0-1.el7_2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:38.7.0-1.el7_2.x86_64",
"product": {
"name": "firefox-0:38.7.0-1.el7_2.x86_64",
"product_id": "firefox-0:38.7.0-1.el7_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/firefox@38.7.0-1.el7_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 7",
"product": {
"name": "SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:38.7.0-1.el7_2.i686 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686"
},
"product_reference": "firefox-0:38.7.0-1.el7_2.i686",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:38.7.0-1.el7_2.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
},
"product_reference": "firefox-0:38.7.0-1.el7_2.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-1952",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1952"
}
],
"notes": [
{
"category": "general",
"text": "Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1952",
"url": "https://www.suse.com/security/cve/CVE-2016-1952"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1952",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1952"
},
{
"cve": "CVE-2016-1954",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1954"
}
],
"notes": [
{
"category": "general",
"text": "The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1954",
"url": "https://www.suse.com/security/cve/CVE-2016-1954"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1954",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1954"
},
{
"cve": "CVE-2016-1957",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1957"
}
],
"notes": [
{
"category": "general",
"text": "Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1957",
"url": "https://www.suse.com/security/cve/CVE-2016-1957"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1957",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1957"
},
{
"cve": "CVE-2016-1958",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1958"
}
],
"notes": [
{
"category": "general",
"text": "browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1958",
"url": "https://www.suse.com/security/cve/CVE-2016-1958"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1958",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1958"
},
{
"cve": "CVE-2016-1960",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1960"
}
],
"notes": [
{
"category": "general",
"text": "Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1960",
"url": "https://www.suse.com/security/cve/CVE-2016-1960"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1960",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1960"
},
{
"cve": "CVE-2016-1961",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1961"
}
],
"notes": [
{
"category": "general",
"text": "Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1961",
"url": "https://www.suse.com/security/cve/CVE-2016-1961"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1961",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1961"
},
{
"cve": "CVE-2016-1962",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1962"
}
],
"notes": [
{
"category": "general",
"text": "Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1962",
"url": "https://www.suse.com/security/cve/CVE-2016-1962"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1962",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1962"
},
{
"cve": "CVE-2016-1964",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1964"
}
],
"notes": [
{
"category": "general",
"text": "Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1964",
"url": "https://www.suse.com/security/cve/CVE-2016-1964"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1964",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1964"
},
{
"cve": "CVE-2016-1965",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1965"
}
],
"notes": [
{
"category": "general",
"text": "Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1965",
"url": "https://www.suse.com/security/cve/CVE-2016-1965"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1965",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1965"
},
{
"cve": "CVE-2016-1966",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1966"
}
],
"notes": [
{
"category": "general",
"text": "The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1966",
"url": "https://www.suse.com/security/cve/CVE-2016-1966"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1966",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1966"
},
{
"cve": "CVE-2016-1973",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1973"
}
],
"notes": [
{
"category": "general",
"text": "Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1973",
"url": "https://www.suse.com/security/cve/CVE-2016-1973"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1973",
"url": "https://bugzilla.suse.com/969894"
},
{
"category": "external",
"summary": "SUSE Bug 970257 for CVE-2016-1973",
"url": "https://bugzilla.suse.com/970257"
},
{
"category": "external",
"summary": "SUSE Bug 970377 for CVE-2016-1973",
"url": "https://bugzilla.suse.com/970377"
},
{
"category": "external",
"summary": "SUSE Bug 970378 for CVE-2016-1973",
"url": "https://bugzilla.suse.com/970378"
},
{
"category": "external",
"summary": "SUSE Bug 970379 for CVE-2016-1973",
"url": "https://bugzilla.suse.com/970379"
},
{
"category": "external",
"summary": "SUSE Bug 970380 for CVE-2016-1973",
"url": "https://bugzilla.suse.com/970380"
},
{
"category": "external",
"summary": "SUSE Bug 970381 for CVE-2016-1973",
"url": "https://bugzilla.suse.com/970381"
},
{
"category": "external",
"summary": "SUSE Bug 970431 for CVE-2016-1973",
"url": "https://bugzilla.suse.com/970431"
},
{
"category": "external",
"summary": "SUSE Bug 970433 for CVE-2016-1973",
"url": "https://bugzilla.suse.com/970433"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-1973"
},
{
"cve": "CVE-2016-1974",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1974"
}
],
"notes": [
{
"category": "general",
"text": "The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1974",
"url": "https://www.suse.com/security/cve/CVE-2016-1974"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1974",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1974"
},
{
"cve": "CVE-2016-1977",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1977"
}
],
"notes": [
{
"category": "general",
"text": "The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1977",
"url": "https://www.suse.com/security/cve/CVE-2016-1977"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-1977",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1977"
},
{
"cve": "CVE-2016-2790",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2790"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2790",
"url": "https://www.suse.com/security/cve/CVE-2016-2790"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2790",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2790"
},
{
"cve": "CVE-2016-2791",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2791"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2791",
"url": "https://www.suse.com/security/cve/CVE-2016-2791"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2791",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2791"
},
{
"cve": "CVE-2016-2792",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2792"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2792",
"url": "https://www.suse.com/security/cve/CVE-2016-2792"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2792",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2792"
},
{
"cve": "CVE-2016-2793",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2793"
}
],
"notes": [
{
"category": "general",
"text": "CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2793",
"url": "https://www.suse.com/security/cve/CVE-2016-2793"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2793",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2793"
},
{
"cve": "CVE-2016-2794",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2794"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2794",
"url": "https://www.suse.com/security/cve/CVE-2016-2794"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2794",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2794"
},
{
"cve": "CVE-2016-2795",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2795"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2795",
"url": "https://www.suse.com/security/cve/CVE-2016-2795"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2795",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2795"
},
{
"cve": "CVE-2016-2796",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2796"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2796",
"url": "https://www.suse.com/security/cve/CVE-2016-2796"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2796",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2796"
},
{
"cve": "CVE-2016-2797",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2797"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2801.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2797",
"url": "https://www.suse.com/security/cve/CVE-2016-2797"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2797",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2797"
},
{
"cve": "CVE-2016-2798",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2798"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2798",
"url": "https://www.suse.com/security/cve/CVE-2016-2798"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2798",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2798"
},
{
"cve": "CVE-2016-2799",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2799"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2799",
"url": "https://www.suse.com/security/cve/CVE-2016-2799"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2799",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2799"
},
{
"cve": "CVE-2016-2800",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2800"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2800",
"url": "https://www.suse.com/security/cve/CVE-2016-2800"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2800",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2800"
},
{
"cve": "CVE-2016-2801",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2801"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2801",
"url": "https://www.suse.com/security/cve/CVE-2016-2801"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2801",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2801"
},
{
"cve": "CVE-2016-2802",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2802"
}
],
"notes": [
{
"category": "general",
"text": "The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2802",
"url": "https://www.suse.com/security/cve/CVE-2016-2802"
},
{
"category": "external",
"summary": "SUSE Bug 969894 for CVE-2016-2802",
"url": "https://bugzilla.suse.com/969894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.i686",
"SUSE Liberty Linux 7:firefox-0:38.7.0-1.el7_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-03-09T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-2802"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…