Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-2837

Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.

Published

2016-08-05T01:59:03.673

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 6.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mozilla firefox ≤ 47.0.1 Yes
Application mozilla firefox 45.1.0 Yes
Application mozilla firefox 45.1.1 Yes
Application mozilla firefox 45.2.0 Yes
Application mozilla firefox 45.3.0 Yes
Operating System oracle linux 5.0 Yes
Operating System oracle linux 6 Yes
Operating System oracle linux 7 Yes
References