{"id":"CVE-2016-1522","aliases":["DEBIAN-CVE-2016-1522","DSA-3479-1","EUVD-2016-2617","GHSA-g9c3-vp28-w6w3","MGASA-2016-0077","MGASA-2016-0078","RHSA-2016:0197","RHSA-2016:0258","RHSA-2016:0594","UBUNTU-CVE-2016-1522","USN-2902-1"],"status":"published","title":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox...","description":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0831,"percentile":0.94968,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-02-08T00:00:00Z","modified":"2026-10-24T10:30:51Z","fixes":[{"ecosystem":"Debian:12","package":"graphite2","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphite2","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphite2","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"graphite2","fixed_in":["1.2.4-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"graphite2","fixed_in":["1.3.5-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1~deb7u1"}]}],"versions":["1.1.3-1","1.1.3-1+powerpcspe1","1.2.0-1","1.2.0-2","1.2.0-3","1.2.0-4","1.2.1-1","1.2.1-2","1.2.1-2+powerpcspe1","1.2.2-1","1.2.2-1+alpha","1.2.2-2","1.2.3-1","1.2.3-1+powerpcspe1","1.2.4-1","1.2.4-1+powerpcspe1","1.2.4-2","1.2.4-3","1.3.0-1","1.3.0-2","1.3.2-1","1.3.2-2","1.3.2-3","1.3.2-4","1.3.3-1","1.3.4-1","1.3.4-2"],"bundled":4},{"source":"osv","ecosystem":"Debian:8","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1~deb8u1"}]}],"versions":["1.2.4-3","1.3.0-1","1.3.0-2","1.3.2-1","1.3.2-2","1.3.2-3","1.3.2-4","1.3.3-1","1.3.4-1","1.3.4-2","1.3.5-1~deb7u1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1.mga5"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1.mga5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el5_11"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el5_11"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el5_11"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el5_11"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el5_11"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el5_11"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el5_11"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el5_11"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu1.1"}]}],"versions":["1.2.3-1","1.2.4-1","1.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1ubuntu1"}]}],"versions":["1.2.4-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu1.1"}]}],"versions":["1.2.3-1","1.2.4-1","1.2.4-1ubuntu1"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"},{"vendor":"sil","product":"graphite2"}],"references":[{"url":"https://security.gentoo.org/glsa/201701-35","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/82991","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2902-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0594.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3479","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0258.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0197.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201701-63","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-14.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1522","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g9c3-vp28-w6w3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1522","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0077.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17780","tags":["report"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0057/","tags":["web","article","report"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0058/","tags":["web","article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0059/","tags":["web","article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0060/","tags":["web","article","report"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0061/","tags":["web","article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-14/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/","tags":["web"]},{"url":"https://www.debian.org/security/2016/dsa-3477","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0078.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17781","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-03/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-0071.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-0197.html","tags":["web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00105.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0197","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-14.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305805","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1306496","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0197.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1521","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1522","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1522","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1523","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1523","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1523","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1317560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1969","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1969","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-38/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0258","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird38.6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301821","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0258.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1930","tags":["advisory"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-01.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1935","tags":["advisory"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-03.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0594","tags":["advisory"]},{"url":"https://raw.githubusercontent.com/silnrsi/graphite/master/ChangeLog","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1308590","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0594.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1526","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1522","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2902-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1526","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1522","description":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:00:00Z","modified":"2024-08-05T23:02:11.533Z","updated_at":"2026-11-02T14:33:35.841056Z"}],"euvd":[{"id":"EUVD-2016-2617","description":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:00:00Z","modified":"2024-08-05T23:02:11Z","updated_at":"2026-11-03T02:22:56.986033Z"}],"ghsa":[{"id":"GHSA-g9c3-vp28-w6w3","title":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox...","description":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.","status":"published","published":"2022-05-17T02:37:55Z","modified":"2023-01-27T05:05:33Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:42:42.951341Z"}],"nvd":[{"id":"CVE-2016-1522","description":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:59:07.93Z","modified":"2026-06-17T00:42:06.923Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-1522","description":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:59:07.93Z","modified":"2026-10-24T10:30:51.215788136Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1522","description":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:59:07.93Z","modified":"2026-09-22T07:01:25.08172057Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1522","description":"Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.","status":"published","published":"2016-02-08T00:00:00Z","modified":"2026-04-22T10:31:01.51217Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DSA-3479-1","title":"graphite2 - security update","status":"published","published":"2016-02-15T00:00:00Z","modified":"2026-03-09T01:22:54.486Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0077","title":"Updated graphite2/firefox packages fix security vulnerability","description":"Multiple vulnerabilities in the graphite2 font library can result in\ninformation disclosure, denial-of-service (application crashes), or code\nexecution via out-of-bounds reads, a NULL pointer dereference, and a\nheap-based buffer overflow (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523,\nCVE-2016-1526).\n\nFirefox includes a bundled copy of the graphite2 library, which has been\nupdated in Firefox ESR 38.6.1.\n","status":"published","published":"2016-02-17T19:06:01Z","modified":"2026-04-16T06:25:09.424629532Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2016-0078","title":"Updated thunderbird packages fix security vulnerability","description":"Several flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Thunderbird to crash or,\npotentially, execute arbitrary code with the privileges of the user\nrunning Thunderbird (CVE-2016-1930, CVE-2016-1935).\n\nMultiple security flaws were found in the graphite2 font library bundled\nwith Thunderbird. A web page containing malicious content could cause\nThunderbird to crash or, potentially, execute arbitrary code with the\nprivileges of the user running Thunderbird (CVE-2016-1521, CVE-2016-1522,\nCVE-2016-1523, CVE-2016-1526).\n\nThunderbird includes a bundled copy of the graphite2 library, which has\nbeen updated in Thunderbird 38.6.0.\n","status":"published","published":"2016-02-17T19:06:01Z","modified":"2026-04-16T06:23:43.83623934Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2016:0197","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-15T23:12:24Z","modified":"2026-06-27T10:04:04Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0258","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-15T23:10:40Z","modified":"2026-06-27T10:04:05Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0594","title":"Red Hat Security Advisory: graphite2 security, bug fix, and enhancement update","status":"published","published":"2024-09-15T23:12:21Z","modified":"2026-06-27T10:04:19Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"USN-2902-1","title":"graphite2 vulnerabilities","description":"Yves Younan discovered that graphite2 incorrectly handled certain malformed\nfonts. If a user or automated system were tricked into opening a specially-\ncrafted font file, a remote attacker could use this issue to cause\ngraphite2 to crash, resulting in a denial of service, or possibly execute\narbitrary code.\n","status":"published","published":"2016-02-17T14:46:52Z","modified":"2026-04-22T09:21:32.639188Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}