CVE-2016-1522

Name of the Vulnerable Software and Affected Versions Graphite 2 versions 1.2.4 and earlier Mozilla Firefox versions prior to 43.0 Mozilla Firefox ESR versions 38.x prior to 38.6.1

Description The issue is caused by a heap-based buffer overflow in the Code.cpp function of the Libgraphite component in Graphite 2, which is used in Mozilla Firefox and Thunderbird. This can be exploited by a remote attacker using a specially crafted Graphite smart font, potentially allowing them to cause a denial of service or execute arbitrary code.

Recommendations For Graphite 2 version 1.2.4 and earlier, update to a version later than 1.2.4 to resolve the issue. For Mozilla Firefox versions prior to 43.0, update to version 43.0 or later. For Mozilla Firefox ESR versions 38.x prior to 38.6.1, update to version 38.6.1 or later.