CVE-2016-1946 Integer overflow in n/a
Remote attackers can cause denial of service or potential code execution in Firefox via crafted metadata triggering integer and buffer overflows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-1946?
CVE-2016-1946 is a critical vulnerability in Mozilla Firefox, published on 31 Jan 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MoofParser::Metadata function in binding/MoofParser.cpp in libstagefright in Mozilla Firefox before 44.0 does not limit the size of read operations, which might allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.
Which versions are affected by CVE-2016-1946?
It affects 3 products.
Products include Mozilla Firefox, Opensuse Leap, Opensuse Opensuse.
How do I fix CVE-2016-1946?
Upgrade to a fixed version.
Is CVE-2016-1946 being exploited?
There is no known exploitation of CVE-2016-1946 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-985w-c5f5-7374, UBUNTU-CVE-2016-1946.