CVE-2016-5270 Memory corruption in n/a
Remote attackers can cause denial of service or potentially execute code via a heap-based buffer overflow in Firefox's text conversion handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-5270?
CVE-2016-5270 is a critical memory corruption vulnerability in Mozilla Firefox, published on 22 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion.
Which versions are affected by CVE-2016-5270?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2016-5270?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2016-5270 being exploited?
There is no known exploitation of CVE-2016-5270 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2016-5270, GHSA-2hcj-223m-pqx5, UBUNTU-CVE-2016-5270.