CVE-2016-2836 Memory corruption in n/a

High 8.8 Published 5 Aug 2016 Updated 5 Aug 2024

Remote attackers can cause denial of service or execute arbitrary code via memory corruption in the browser engine.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2016-2836?

CVE-2016-2836 is a high-severity memory corruption vulnerability in Mozilla Firefox, published on 5 Aug 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors.

Weakness: CWE-119

Which versions are affected by CVE-2016-2836?

It affects 1 product.

Linux distribution packages (16)

`thunderbird` Red Hat:enterprise_linux:5::client	All versions	`0:45.3.0-1.el5_11`
`thunderbird-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:45.3.0-1.el5_11`
`thunderbird` Red Hat:enterprise_linux:6::client	All versions	`0:45.3.0-1.el6_8`
`thunderbird-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:45.3.0-1.el6_8`
`thunderbird` Red Hat:enterprise_linux:6::server	All versions	`0:45.3.0-1.el6_8`
`thunderbird-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:45.3.0-1.el6_8`
`thunderbird` Red Hat:enterprise_linux:6::workstation	All versions	`0:45.3.0-1.el6_8`
`thunderbird-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:45.3.0-1.el6_8`
`thunderbird` Red Hat:enterprise_linux:7::client	All versions	`0:45.3.0-1.el7_2`
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:45.3.0-1.el7_2`
`thunderbird` Red Hat:enterprise_linux:7::server	All versions	`0:45.3.0-1.el7_2`
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:45.3.0-1.el7_2`
`thunderbird` Red Hat:enterprise_linux:7::workstation	All versions	`0:45.3.0-1.el7_2`
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:45.3.0-1.el7_2`
`thunderbird` Red Hat:rhel_productivity:5	All versions	`0:45.3.0-1.el5_11`
`thunderbird-debuginfo` Red Hat:rhel_productivity:5	All versions	`0:45.3.0-1.el5_11`

Products include Mozilla Firefox.

How do I fix CVE-2016-2836?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2016-2836 being exploited?

There is no known exploitation of CVE-2016-2836 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-2836, DLA-640-1, DSA-3686-1, GHSA-458f-jrrc-3qjf, MGASA-2016-0330, RHSA-2016:1809 and 2 more.