« Back to list

CVE-2016-2814

Status: ModifiedHigh (8.8)—

Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Mozilla — Firefox

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2016-2814",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-04-30T17:59:12.447",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00023.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00054.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00057.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0695.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.debian.org/security/2016/dsa-3559",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-44.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1035692",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2936-1",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2936-2",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2936-3",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1254721",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201701-15",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00023.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00054.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00057.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0695.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2016/dsa-3559",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2016/mfsa2016-44.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1035692",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2936-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2936-2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2936-3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1254721",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201701-15",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de buffer basado en memoria dinámica en la función stagefright::SampleTable::parseSampleCencInfo en libstagefright en Mozilla Firefox en versiones anteriores a 46.0, Firefox ESR 38.x en versiones anteriores a 38.8 y Firefox ESR 45.x en versiones anteriores a 45.1 permite a atacantes remotos ejecutar código arbitrario a través de desplazamientos CENC manipulados que conducen a administración incorrecta de la tabla de tamaños"
    }
  ],
  "lastModified": "2026-06-17T00:44:30.607",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97000851-C511-487E-A5E8-FCB173D76624",
              "versionEndIncluding": "45.0.2"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35BF0AFB-26BA-4BEA-B6B8-11CF88E951DE"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F007CC6-9391-4E1C-A747-F3DE5E572FA5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45E9641F-430C-4B3A-BD63-EC13DBD3D1E4"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AADD23B-A8AF-4679-990D-C29A1D6EB5CD"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1343A1FD-98CF-4A6C-A697-1253E538FD5C"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D098567-B55E-4EAC-8FAA-31FAFDD4058F"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE0389BC-D295-4957-8AE7-EDAC770F596D"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E75E69A5-AC94-4F35-9EFB-1BFF8B78210D"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2765E663-C9CF-476A-B7A8-6F02D0E2D72D"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62B4E871-0ACB-4EC5-8392-EAD0DF25E64B"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "435D6EF5-C879-4121-9D47-EF2236E53409"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5963D11-D2F4-40A7-81CE-E034C91FCCBD"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FB022A7-B792-4AC0-B2CF-AF6F384AE719"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1AD923B9-A845-4D1E-A59F-2A0D3D01E4D3"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:38.7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADBAD0F4-42B5-4A0A-BB0D-08F92C9DF238"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:45.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB24CED1-AAEB-41E8-9C02-71E19EDC0086"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}