This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2016-1969 →
DEBIAN-CVE-2016-1969
The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to...
Original description
The description as published by the source.
The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
firefox-esr
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.0esr-1"}]}]
Debian:13
firefox-esr
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.0esr-1"}]}]
Debian:14
firefox-esr
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.0esr-1"}]}]
Debian:12
graphite2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]
Debian:13
graphite2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]
Debian:14
graphite2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]
References
- advisory security-tracker.debian.org