VYPR
← All advisories
High severity8.8NVD Advisory· Published Mar 13, 2016· Updated May 6, 2026

CVE-2016-1969

CVE-2016-1969

Description

The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.

Affected products

14
  • Mozilla Corporation/Firefox13 versions
    cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 12 more
    • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <=44.0.2
    • cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:38.6.0:*:*:*:*:*:*:*
  • Sil/Graphite2
    cpe:2.3:a:sil:graphite2:*:*:*:*:*:*:*:*
    Range: <=1.3.5

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.