CVE-2016-2807: mozilla firefox

Modified

AliasesUBUNTU-CVE-2016-2807DEBIAN-CVE-2016-2807

Published 30-04-2016Last modified 05-08-2024

Vulnerability summary

CVE-2016-2807 is a high (CVSS 10.0) vulnerability in mozilla firefox. EPSS estimates a 4.69% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

4.69%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 9

DLA-472-1 DSA-3559-1 DSA-3576-1 MGASA-2016-0158 MGASA-2016-0254 OPENSUSE-SU-2016:1769-1+10 more

Timeline

30-04-2016
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.08.8v2.010.0

EPSS trend

Probability

4.69%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.69% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Opensuse2 products

leapEOL42.1
opensuseEOL13.1 | 13.2

Ubuntu2 products

firefox< 46.0+build5-0ubuntu0.14.04.2 | < 46.0+build5-0ubuntu0.16.04.2
thunderbird< 1:38.8.0+build1-0ubuntu0.14.04.1 | < 1:38.8.0+build1-0ubuntu0.16.04.1

Debian1 product

firefox-esr< 45.1.0esr-1

Mozilla1 product

firefox≤ 45.0.2 | 38.0 | 38.0.1 | 38.0.5 | 38.1.0 | 38.1.1 | 38.2.0 | 38.2.1 | 38.3.0 | 38.4.0 | 38.5.0 | 38.5.1 | 38.6.0 | 38.6.1 | 38.7.0 | 38.7.1 | 45.0.1

Suse1 product