CVE-2016-5263

Low

Low Medium High Critical

CVSS Score

Published: Aug 05, 2016

Last Modified: Apr 12, 2025

Vulnerability Description

The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion."

Known Affected Software

7 configuration(s) from 2 vendor(s)

firefox

Version:

45.1.0

CPE:

cpe:2.3:a:mozilla:firefox:45.1.0:*:*:*:esr:*:*:*

firefox

Version:

45.3.0

CPE:

cpe:2.3:a:mozilla:firefox:45.3.0:*:*:*:esr:*:*:*

firefox

Version:

45.2.0

CPE:

cpe:2.3:a:mozilla:firefox:45.2.0:*:*:*:esr:*:*:*

firefox

Version:

45.1.1

CPE:

cpe:2.3:a:mozilla:firefox:45.1.1:*:*:*:esr:*:*:*

linux

Version:

5.0

CPE:

cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:*

linux

Version:

CPE:

cpe:2.3:o:oracle:linux:7:8:*:*:*:*:*:*

linux

Version:

CPE:

cpe:2.3:o:oracle:linux:6:10:*:*:*:*:*:*

This vulnerability affects 7 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-704

Incorrect Type Conversion or Cast

Description: The product does not correctly convert an object, resource, or structure from one type to a different type.
Typical Severity: Medium
Abstraction Level: Class