{"id":"CVE-2016-1523","aliases":["DEBIAN-CVE-2016-1523","DSA-3477-1","DSA-3479-1","DSA-3491-1","EUVD-2016-2618","GHSA-996f-83x4-9fpc","MGASA-2016-0077","MGASA-2016-0078","RHSA-2016:0197","RHSA-2016:0258","RHSA-2016:0594","SUSE-SU-2016:0554-1","SUSE-SU-2016:0564-1","SUSE-SU-2016:0584-1","SUSE-SU-2016:0779-1","UBUNTU-CVE-2016-1523","USN-2902-1","USN-2904-1"],"status":"published","title":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in...","description":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02318,"percentile":0.83551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2016-02-08T00:00:00Z","modified":"2026-10-24T10:30:19Z","fixes":[{"ecosystem":"Debian:12","package":"graphite2","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphite2","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphite2","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"MozillaFirefox","fixed_in":["38.6.1esr-60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"MozillaFirefox","fixed_in":["38.6.1esr-60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"MozillaFirefox","fixed_in":["38.6.1esr-60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"MozillaFirefox","fixed_in":["38.6.1esr-60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"MozillaFirefox","fixed_in":["38.6.1esr-60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"MozillaFirefox","fixed_in":["38.6.1esr-60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"MozillaFirefox","fixed_in":["38.6.1esr-60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"MozillaFirefox","fixed_in":["38.6.1esr-60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"MozillaFirefox","fixed_in":["38.6.1esr-34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"MozillaFirefox","fixed_in":["38.6.1esr-34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"MozillaFirefox","fixed_in":["38.6.1esr-34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"MozillaFirefox","fixed_in":["38.6.1esr-34.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"graphite2","fixed_in":["1.2.4-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","fixed_in":["1:38.6.0+build1-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"graphite2","fixed_in":["1.3.5-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","fixed_in":["1:38.6.0+build1-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"iceweasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-1~deb7u1"}]}],"versions":["10.0.12esr-1","10.0.12esr-1+alpha","10.0.12esr-1+nmu1","10.0.12esr-1+nmu1+alpha","11.0-1","11.0-2","11.0-3","11.0-4","11.0~b1-1","11.0~b1-2","11.0~b2-1","11.0~b3-1","11.0~b4-1","11.0~b5-1","11.0~b6-1","12.0-1","12.0-2","12.0-3","12.0-4","12.0-5","12.0-6","12.0-7","13.0-1","13.0.1-1","13.0.1-2","14.0.1-1","14.0.1-2","15.0-1","15.0.1-1","16.0-1","16.0.1-1","16.0.2-1","17.0-1","17.0.1-1","17.0.1-2","17.0.10esr-1~deb7u1","17.0.5esr-1","17.0.6esr-1","17.0.6esr-1~deb7u1","17.0.7esr-1","17.0.7esr-1~deb7u1","17.0.7esr-2","17.0.8esr-1","17.0.8esr-1~deb7u1","17.0.8esr-2","17.0.8esr-2~deb7u1","17.0.9esr-1~deb7u1","18.0-1","18.0.1-1","18.0.2-1","19.0-1","19.0.2-1","20.0-1","21.0-1","22.0-1","23.0-1","23.0-2","23.0.1-1","24.0-1","24.0-2","24.0~b4-1","24.0~b7-1","24.0~b9-1","24.1.0esr-1","24.1.0esr-1+powerpcspe1","24.2.0esr-1","24.2.0esr-1+alpha","24.2.0esr-1+powerpcspe1","24.3.0esr-1","24.3.0esr-1+alpha","24.3.0esr-1~deb7u1","24.4.0esr-1","24.4.0esr-1~deb7u2","24.5.0esr-1","24.5.0esr-1~deb7u1","24.6.0esr-1~deb7u1","24.7.0esr-1~deb7u1","24.8.0esr-1~deb7u1","24.8.1esr-1~deb7u1","25.0-1","25.0~b3-1","25.0~b9-1","26.0-1","27.0-1","27.0-2","27.0.1-1","28.0-1","29.0-1","29.0-2","29.0.1-1","29.0.1-1+alpha","29.0.1-2","30.0-1","30.0-2","30.0~b3-1","30.0~b5-1","30.0~b5-2","30.0~b5-3","30.0~b7-1","31.0-1","31.0-2","31.0-3","31.0~b1-1","31.0~b3-1","31.1.0esr-1","31.2.0esr-1","31.2.0esr-1~deb7u1","31.2.0esr-2","31.2.0esr-2+hurd.0","31.2.0esr-2~deb7u1","31.2.0esr-3","31.2.0esr-3~deb7u1","31.3.0esr-1","31.3.0esr-1+powerpcspe1","31.3.0esr-1~deb7u1","31.4.0esr-1","31.4.0esr-1~deb7u1","31.5.0esr-1","31.5.0esr-1~deb7u1","31.5.3esr-1","31.5.3esr-1~deb7u1","31.6.0esr-1","31.6.0esr-1~deb7u1","31.7.0esr-1~deb7u1","31.7.0esr-1~deb8u1","31.8.0esr-1~deb7u1","31.8.0esr-1~deb8u1","32.0-1","32.0.3-1","32.0~b1-1","32.0~b3-1","32.0~b5-1","33.0-1","33.0-2","33.1-1","34.0-1","35.0-1","35.0.1-1","36.0-1","36.0-2","36.0.1-1","36.0.1-2","36.0.4-1","37.0-1","37.0.1-1","37.0.2-1","38.0-1","38.0-2","38.0.1-1","38.0.1-2","38.0.1-3","38.0.1-4","38.0.1-5","38.1.0esr-1","38.1.0esr-2","38.1.0esr-3","38.1.1esr-1","38.1.1esr-1~deb9u1","38.2.0esr-1","38.2.0esr-1~deb7u1","38.2.0esr-1~deb8u1","38.2.0esr-1~stretch","38.2.1esr-1","38.2.1esr-1~deb7u1","38.2.1esr-1~deb8u1","38.3.0esr-1","38.3.0esr-1~deb7u1","38.3.0esr-1~deb8u1","38.4.0esr-1","38.4.0esr-1~deb7u1","38.4.0esr-1~deb8u1","38.5.0esr-1","38.5.0esr-1~deb7u2","38.5.0esr-1~deb8u1","38.5.0esr-1~deb8u2","38.6.0esr-1~deb7u1","38.6.0esr-1~deb8u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"iceweasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-1~deb8u1"}]}],"versions":["31.6.0esr-1","31.7.0esr-1~deb7u1","31.7.0esr-1~deb8u1","31.8.0esr-1~deb7u1","31.8.0esr-1~deb8u1","32.0-1","32.0.3-1","32.0~b1-1","32.0~b3-1","32.0~b5-1","33.0-1","33.0-2","33.1-1","34.0-1","35.0-1","35.0.1-1","36.0-1","36.0-2","36.0.1-1","36.0.1-2","36.0.4-1","37.0-1","37.0.1-1","37.0.2-1","38.0-1","38.0-2","38.0.1-1","38.0.1-2","38.0.1-3","38.0.1-4","38.0.1-5","38.1.0esr-1","38.1.0esr-2","38.1.0esr-3","38.1.1esr-1","38.1.1esr-1~deb9u1","38.2.0esr-1","38.2.0esr-1~deb7u1","38.2.0esr-1~deb8u1","38.2.0esr-1~stretch","38.2.1esr-1","38.2.1esr-1~deb7u1","38.2.1esr-1~deb8u1","38.3.0esr-1","38.3.0esr-1~deb7u1","38.3.0esr-1~deb8u1","38.4.0esr-1","38.4.0esr-1~deb7u1","38.4.0esr-1~deb8u1","38.5.0esr-1","38.5.0esr-1~deb7u2","38.5.0esr-1~deb8u1","38.5.0esr-1~deb8u2","38.6.0esr-1~deb7u1","38.6.0esr-1~deb8u1","38.6.1esr-1~deb7u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1~deb7u1"}]}],"versions":["1.1.3-1","1.1.3-1+powerpcspe1","1.2.0-1","1.2.0-2","1.2.0-3","1.2.0-4","1.2.1-1","1.2.1-2","1.2.1-2+powerpcspe1","1.2.2-1","1.2.2-1+alpha","1.2.2-2","1.2.3-1","1.2.3-1+powerpcspe1","1.2.4-1","1.2.4-1+powerpcspe1","1.2.4-2","1.2.4-3","1.3.0-1","1.3.0-2","1.3.2-1","1.3.2-2","1.3.2-3","1.3.2-4","1.3.3-1","1.3.4-1","1.3.4-2"],"bundled":4},{"source":"osv","ecosystem":"Debian:8","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1~deb8u1"}]}],"versions":["1.2.4-3","1.3.0-1","1.3.0-2","1.3.2-1","1.3.2-2","1.3.2-3","1.3.2-4","1.3.3-1","1.3.4-1","1.3.4-2","1.3.5-1~deb7u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"icedove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1~deb7u1"}]}],"versions":["10.0.12-1","11.0-1","16.0.2-1","17.0-1","17.0.10-1","17.0.10-1+powerpcspe1","17.0.10-1+powerpcspe2","17.0.10-1~deb7u1","17.0.2-1","17.0.4-1","17.0.5-1","17.0.5-2","17.0.7-1","17.0.7-1~deb7u1","17.0.8-1","17.0.8-1~deb7u1","17.0.9-1","17.0.9-1~deb7u1","17.0.9-2","24.0-1","24.0~b3-2","24.1.1-1","24.2.0-1","24.2.0-1+alpha","24.2.0-1+powerpcspe1","24.3.0-1","24.3.0-2","24.4.0-1","24.4.0-1~deb7u1","24.5.0-1","24.5.0-1~deb7u1","24.5.0-2","24.6.0-1~deb7u1","24.7.0-1~deb7u1","24.8.0-1~deb7u1","24.8.1-1~deb7u1","30.0~b1-1","31.0-1","31.0-2","31.0-3","31.0~b1-2","31.0~b2-1","31.1.2-1","31.2.0-1","31.2.0-1~deb7u1","31.3.0-1","31.3.0-1+powerpcspe1","31.3.0-1~deb7u1","31.4.0-1","31.4.0-1~deb7u1","31.4.0-2","31.5.0-1","31.5.0-1~deb7u1","31.6.0-1","31.6.0-1~deb7u1","31.7.0-1","31.7.0-1~deb7u1","31.7.0-1~deb8u1","31.8.0-1~deb7u1","31.8.0-1~deb8u1","31.8.0-1~deb8u1+kbsd11","32.0~b1-1","33.0~b1-1","34.0~b1-1","34.0~b1-2","36.0~b1-1","36.0~b1-2","38.0.1-1","38.0~b2-1","38.0~b5-1","38.1.0-1","38.2.0-1","38.2.0-1~stretch","38.2.0-2","38.3.0-1","38.3.0-1~deb7u1","38.3.0-1~deb8u1","38.3.0-2","38.4.0-1","38.4.0-1~deb7u1","38.4.0-1~deb8u1","38.5.0-1","38.5.0-1~deb7u1","38.5.0-1~deb8u1"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"icedove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1~deb8u1"}]}],"versions":["31.6.0-1","31.7.0-1","31.7.0-1~deb7u1","31.7.0-1~deb8u1","31.8.0-1~deb7u1","31.8.0-1~deb8u1","31.8.0-1~deb8u1+kbsd11","32.0~b1-1","33.0~b1-1","34.0~b1-1","34.0~b1-2","36.0~b1-1","36.0~b1-2","38.0.1-1","38.0~b2-1","38.0~b5-1","38.1.0-1","38.2.0-1","38.2.0-1~stretch","38.2.0-2","38.3.0-1","38.3.0-1~deb7u1","38.3.0-1~deb8u1","38.3.0-2","38.4.0-1","38.4.0-1~deb7u1","38.4.0-1~deb8u1","38.5.0-1","38.5.0-1~deb7u1","38.5.0-1~deb8u1","38.6.0-1~deb7u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1.mga5"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1.mga5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el5_11"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el5_11"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el5_11"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el5_11"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el6_7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.1-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el5_11"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el5_11"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el5_11"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el5_11"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el6_7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:38.6.0-1.el7_2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-33.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38-15.58"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-17.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu1.1"}]}],"versions":["1.2.3-1","1.2.4-1","1.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:38.6.0+build1-0ubuntu0.14.04.1"}]}],"versions":["1:24.0+build1-0ubuntu1","1:24.0+build1-0ubuntu2","1:24.1.1+build1-0ubuntu0.13.10.1","1:24.1.1+build1-0ubuntu1","1:24.2.0+build1-0ubuntu1","1:24.4.0+build1-0ubuntu1","1:24.5.0+build1-0ubuntu0.14.04.1","1:24.6.0+build1-0ubuntu0.14.04.1","1:31.0+build1-0ubuntu0.14.04.1","1:31.1.1+build1-0ubuntu0.14.04.1","1:31.1.2+build1-0ubuntu0.14.04.1","1:31.2.0+build2-0ubuntu0.14.04.1","1:31.3.0+build1-0ubuntu0.14.04.1","1:31.4.0+build1-0ubuntu0.14.04.1","1:31.5.0+build1-0ubuntu0.14.04.1","1:31.6.0+build1-0ubuntu0.14.04.1","1:31.7.0+build1-0ubuntu0.14.04.1","1:31.8.0+build1-0ubuntu0.14.04.1","1:38.2.0+build1-0ubuntu0.14.04.1","1:38.3.0+build1-0ubuntu0.14.04.1","1:38.4.0+build3-0ubuntu0.14.04.1","1:38.5.1+build2-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1ubuntu1"}]}],"versions":["1.2.4-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:38.6.0+build1-0ubuntu1"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu1.1"}]}],"versions":["1.2.3-1","1.2.4-1","1.2.4-1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:38.6.0+build1-0ubuntu0.14.04.1"}]}],"versions":["1:24.0+build1-0ubuntu1","1:24.0+build1-0ubuntu2","1:24.1.1+build1-0ubuntu0.13.10.1","1:24.1.1+build1-0ubuntu1","1:24.2.0+build1-0ubuntu1","1:24.4.0+build1-0ubuntu1","1:24.5.0+build1-0ubuntu0.14.04.1","1:24.6.0+build1-0ubuntu0.14.04.1","1:31.0+build1-0ubuntu0.14.04.1","1:31.1.1+build1-0ubuntu0.14.04.1","1:31.1.2+build1-0ubuntu0.14.04.1","1:31.2.0+build2-0ubuntu0.14.04.1","1:31.3.0+build1-0ubuntu0.14.04.1","1:31.4.0+build1-0ubuntu0.14.04.1","1:31.5.0+build1-0ubuntu0.14.04.1","1:31.6.0+build1-0ubuntu0.14.04.1","1:31.7.0+build1-0ubuntu0.14.04.1","1:31.8.0+build1-0ubuntu0.14.04.1","1:38.2.0+build1-0ubuntu0.14.04.1","1:38.3.0+build1-0ubuntu0.14.04.1","1:38.4.0+build3-0ubuntu0.14.04.1","1:38.5.1+build2-0ubuntu0.14.04.1"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"},{"vendor":"sil","product":"graphite2"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-35","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3491","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/82991","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3477","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2902-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00055.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0594.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1035017","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3479","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html","tags":["x_refsource_MISC","x_transferred","article","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0258.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2904-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1246093","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201605-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0197.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-63","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-14.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1523","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-996f-83x4-9fpc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1523","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0077.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17780","tags":["report"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0057/","tags":["web","article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0058/","tags":["web","article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0059/","tags":["web","article","report"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0060/","tags":["web","article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0061/","tags":["web","article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-14/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/","tags":["web"]},{"url":"https://www.debian.org/security/2016/dsa-3477","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0078.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17781","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-03/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-0071.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-0197.html","tags":["web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00105.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0197","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-14.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305805","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1306496","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0197.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1521","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1522","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1522","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1522","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1523","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1523","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1317560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1969","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1969","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-38/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0258","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird38.6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301821","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0258.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1930","tags":["advisory"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-01.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1935","tags":["advisory"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-03.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0594","tags":["advisory"]},{"url":"https://raw.githubusercontent.com/silnrsi/graphite/master/ChangeLog","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1308590","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0594.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1526","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160554-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/967087","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1523","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160564-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160584-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/954447","tags":["report"]},{"url":"https://bugzilla.suse.com/959888","tags":["report"]},{"url":"https://bugzilla.suse.com/963520","tags":["report"]},{"url":"https://bugzilla.suse.com/963632","tags":["report"]},{"url":"https://bugzilla.suse.com/963635","tags":["report"]},{"url":"https://bugzilla.suse.com/963731","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1938","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160779-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/965803","tags":["report"]},{"url":"https://bugzilla.suse.com/965807","tags":["report"]},{"url":"https://bugzilla.suse.com/965810","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1526","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-1523","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2902-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2904-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1935","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1523","description":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:00:00Z","modified":"2024-08-05T23:02:11.56Z","updated_at":"2026-11-02T14:33:36.175943Z"}],"euvd":[{"id":"EUVD-2016-2618","description":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:00:00Z","modified":"2024-08-05T23:02:11Z","updated_at":"2026-11-03T02:22:56.986033Z"}],"ghsa":[{"id":"GHSA-996f-83x4-9fpc","title":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in...","description":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.","status":"published","published":"2022-05-17T02:37:55Z","modified":"2023-01-27T05:05:20Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T14:42:40.370534Z"}],"nvd":[{"id":"CVE-2016-1523","description":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:59:08.9Z","modified":"2026-06-17T00:42:07.09Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-1523","description":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:59:08.9Z","modified":"2026-10-24T10:30:19.887172411Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1523","description":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:59:08.9Z","modified":"2026-09-22T07:01:25.595471418Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1523","description":"The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-08T00:00:00Z","modified":"2026-04-22T10:31:21.284422Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DSA-3477-1","title":"iceweasel - security update","status":"published","published":"2016-02-14T00:00:00Z","modified":"2026-03-09T01:21:52.265063Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3479-1","title":"graphite2 - security update","status":"published","published":"2016-02-15T00:00:00Z","modified":"2026-03-09T01:22:54.486Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3491-1","title":"icedove - security update","status":"published","published":"2016-02-24T00:00:00Z","modified":"2026-03-09T01:18:15.519171Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0077","title":"Updated graphite2/firefox packages fix security vulnerability","description":"Multiple vulnerabilities in the graphite2 font library can result in\ninformation disclosure, denial-of-service (application crashes), or code\nexecution via out-of-bounds reads, a NULL pointer dereference, and a\nheap-based buffer overflow (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523,\nCVE-2016-1526).\n\nFirefox includes a bundled copy of the graphite2 library, which has been\nupdated in Firefox ESR 38.6.1.\n","status":"published","published":"2016-02-17T19:06:01Z","modified":"2026-04-16T06:25:09.424629532Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2016-0078","title":"Updated thunderbird packages fix security vulnerability","description":"Several flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Thunderbird to crash or,\npotentially, execute arbitrary code with the privileges of the user\nrunning Thunderbird (CVE-2016-1930, CVE-2016-1935).\n\nMultiple security flaws were found in the graphite2 font library bundled\nwith Thunderbird. A web page containing malicious content could cause\nThunderbird to crash or, potentially, execute arbitrary code with the\nprivileges of the user running Thunderbird (CVE-2016-1521, CVE-2016-1522,\nCVE-2016-1523, CVE-2016-1526).\n\nThunderbird includes a bundled copy of the graphite2 library, which has\nbeen updated in Thunderbird 38.6.0.\n","status":"published","published":"2016-02-17T19:06:01Z","modified":"2026-04-16T06:23:43.83623934Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2016:0197","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-15T23:12:24Z","modified":"2026-06-27T10:04:04Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0258","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-15T23:10:40Z","modified":"2026-06-27T10:04:05Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0594","title":"Red Hat Security Advisory: graphite2 security, bug fix, and enhancement update","status":"published","published":"2024-09-15T23:12:21Z","modified":"2026-06-27T10:04:19Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:0554-1","title":"Security update for MozillaFirefox","description":"\nThis update for MozillaFirefox fixes the following issues: \n\n- update to Firefox 38.6.1 ESR (bsc#967087)\n  * MFSA 2016-14/CVE-2016-1523\n    (bmo#1246093)\n    Vulnerabilities in Graphite 2\n","status":"published","published":"2016-02-24T09:06:06Z","modified":"2026-02-04T03:09:14.424746Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0564-1","title":"Security update for MozillaFirefox","description":"\nThis update for MozillaFirefox fixes the following issues: \n\n- update to Firefox 38.6.1 ESR (bsc#967087)\n  * MFSA 2016-14/CVE-2016-1523\n    (bmo#1246093)\n    Vulnerabilities in Graphite 2\n","status":"published","published":"2016-02-24T13:21:54Z","modified":"2026-02-04T03:52:04.487432Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0584-1","title":"Security update for MozillaFirefox, MozillaFirefox-branding-SLED, MozillaFirefox-branding-SLES-for-VMware, mozilla-nss","description":"\nThis update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss fixes the following issues: \n\nFirefox 38.6.1 ESR (bsc#967087)\n\nThe following vulnerabilities were fixed:\n\n- CVE-2016-1523: Fixed denial of service in Graphite 2 library (MFSA 2016-14/bmo#1246093)\n\nFirefox 38.6.0 ESR + Mozilla NSS 3.20.2. (bsc#963520)\n\nThe following vulnerabilities were fixed:\n\n- CVE-2016-1930: Memory safety bugs fixed in Firefox ESR 38.6 (bsc#963632)\n- CVE-2016-1935: Buffer overflow in WebGL after out of memory allocation (bsc#963635)\n- CVE-2016-1938: Calculations with mp_div and mp_exptmod in Network Security Services (NSS) canproduce wrong results (bsc#963731)\n- CVE-2015-7575: MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature (bsc#959888)\n\nThe following improvements were added:\n\n- bsc#954447: Mozilla NSS now supports a number of new DHE ciphersuites\n- Tracking protection is now enabled by default\n","status":"published","published":"2016-02-25T15:19:11Z","modified":"2026-02-04T03:40:02.487486Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0779-1","title":"Security update for graphite2","description":"\nThis update for graphite2 fixes the following issues:\n\n- CVE-2016-1521: The directrun function in directmachine.cpp in\n  Libgraphite did not validate a certain skip operation, which allowed\n  remote attackers to execute arbitrary code, obtain sensitive information,\n  or cause a denial of service (out-of-bounds read and application crash)\n  via a crafted Graphite smart font.\n\n- CVE-2016-1523: The SillMap::readFace function in FeatureMap.cpp in\n  Libgraphite mishandled a return value, which allowed remote attackers\n  to cause a denial of service (missing initialization, NULL pointer\n  dereference, and application crash) via a crafted Graphite smart font.\n\n- CVE-2016-1526: The TtfUtil:LocaLookup function in TtfUtil.cpp in\n  Libgraphite incorrectly validated a size value, which allowed remote\n  attackers to obtain sensitive information or cause a denial of service\n  (out-of-bounds read and application crash) via a crafted Graphite\n  smart font.\n","status":"published","published":"2016-03-15T17:01:26Z","modified":"2026-02-04T04:29:46.099165Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"USN-2902-1","title":"graphite2 vulnerabilities","description":"Yves Younan discovered that graphite2 incorrectly handled certain malformed\nfonts. If a user or automated system were tricked into opening a specially-\ncrafted font file, a remote attacker could use this issue to cause\ngraphite2 to crash, resulting in a denial of service, or possibly execute\narbitrary code.\n","status":"published","published":"2016-02-17T14:46:52Z","modified":"2026-04-22T09:21:32.639188Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-2904-1","title":"thunderbird vulnerabilities","description":"Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly\nallowed MD5 to be used for TLS 1.2 connections. If a remote attacker were\nable to perform a machine-in-the-middle attack, this flaw could be exploited to\nview sensitive information. (CVE-2015-7575)\n\nYves Younan discovered that graphite2 incorrectly handled certain malformed\nfonts. If a user were tricked into opening a specially crafted website in a\nbrowsing context, an attacker could potentially exploit this to cause a\ndenial of service via application crash, or execute arbitary code with the\nprivileges of the user invoking Thunderbird. (CVE-2016-1523)\n\nBob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman,\nCarsten Book, and Randell Jesup discovered multiple memory safety issues\nin Thunderbird. If a user were tricked in to opening a specially crafted\nwebsite in a browsing context, an attacker could potentially exploit these\nto cause a denial of service via application crash, or execute arbitrary\ncode with the privileges of the user invoking Thunderbird. (CVE-2016-1930)\n\nAki Helin discovered a buffer overflow when rendering WebGL content in\nsome circumstances. If a user were tricked in to opening a specially\ncrafted website in a browsing context, an attacker could potentially\nexploit this to cause a denial of service via application crash, or\nexecute arbitrary code with the privileges of the user invoking\nThunderbird. (CVE-2016-1935)\n","status":"published","published":"2016-03-08T12:13:10Z","modified":"2026-04-22T09:21:54.884479Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}