CVE-2016-2836
Publication date 3 August 2016
Last updated 25 August 2025
Ubuntu priority
Description
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 16.04 LTS xenial |
Fixed 48.0+build2-0ubuntu0.16.04.1
|
| 14.04 LTS trusty |
Fixed 48.0+build2-0ubuntu0.14.04.1
|
|
| thunderbird | 16.04 LTS xenial |
Fixed 1:45.3.0+build1-0ubuntu0.16.04.2
|
| 14.04 LTS trusty |
Fixed 1:45.3.0+build1-0ubuntu0.14.04.4
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
8.8 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-3073-1
- Thunderbird vulnerabilities
- 22 September 2016
- USN-3044-1
- Firefox vulnerabilities
- 5 August 2016