CVE-2016-2801 - CVE House

Back to Database

Status published High CVE-2016-2801

The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6,...

8.8 CVSS

Vulnerability Description

The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-2801

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from opensuse

View All →

Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec...

Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver *...

Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv...

Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv...

Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv...

Affected Vendor

opensuse

View all reports →

Affected Software

leap, opensuse, linux enterprise, graphite2, linux, firefox

Vulnerable Versions:

42.1, 13.1, 13.2, 12.0, 0, 5.0, 6, 7, 38.0, 38.0.1, 38.0.5, 38.1.0, 38.1.1, 38.2.0, 38.2.1, 38.3.0, 38.4.0, 38.5.0, 38.5.1, 38.6.0, 38.6.1

Timeline

Official Publish: March 13th, 2016

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.