CVE-2016-2837 | BDVDB-2026-77471 Detail
Description#
Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.mozilla.org/security/announce/2016/mfsa2016-77.html
- http://www.debian.org/security/2016/dsa-3640
- http://www.securitytracker.com/id/1036508
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.ubuntu.com/usn/USN-3044-1
- http://www.securityfocus.com/bid/92258
- http://rhn.redhat.com/errata/RHSA-2016-1551.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1274637
- https://security.gentoo.org/glsa/201701-15
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html
- http://www.zerodayinitiative.com/advisories/ZDI-16-673
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.