Published: 13/03/2016 Updated: 03/12/2016

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Integer underflow in Brotli, as used in Mozilla Firefox prior to 45.0, allows remote malicious users to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox

Debian Bug report logs - #817233 brotli: CVE-2016-1624 CVE-2016-1968 Package: src:brotli; Maintainer for src:brotli is Tomasz Buchert <tomasz@debianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Wed, 9 Mar 2016 07:54:10 UTC Severity: grave Tags: fixed-upstream, patch, security, upstream Found in vers ...

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

USN-2917-1 introduced several regressions in Firefox ...

Mozilla Foundation Security Advisory 2016-30 Buffer overflow in Brotli decompression Announced March 8, 2016 Reporter Luke Li Impact High Products Firefox Fixed in Firefox 45 ...

The repo has been migrated to Bitbucket https://bitbucket.org/dtnse/jbrotli/src/master/ and archived

jBrotli Java bindings for Brotli: a new compression algorithm for the internet License Supported operating systems and architectures jbrotli provides platform dependant bindings for Google's brotli library Thus each target platform which is provided here was compiled and tested for the following operating systems and architectures Windows 7 or newer, x86 64bit Windows

CWE-189 http://www.mozilla.org/security/announce/2016/mfsa2016-30.html https://bugzilla.mozilla.org/show_bug.cgi?id=1246742 https://security.gentoo.org/glsa/201605-06 http://www.ubuntu.com/usn/USN-2917-2 http://www.ubuntu.com/usn/USN-2917-1 http://www.securitytracker.com/id/1035215 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html http://www.ubuntu.com/usn/USN-2917-3 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=817233 https://nvd.nist.gov https://github.com/MeteoGroup/jbrotli https://usn.ubuntu.com/2917-1/

CVE-2016-1968

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect