{"id":"CVE-2016-2790","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-2790","generatedAt":"2026-10-27T18:46:51.805Z","title":"The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a…","description":"The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.","published":"2016-03-13T18:59:29.000Z","lastModified":"2026-06-17T00:44:24.000Z","status":"Modified","sourceIdentifier":"security@mozilla.org","cvss":{"version":"3.0","score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-19"],"affected":["opensuse/leap","opensuse/opensuse","suse/linux enterprise","mozilla/firefox","sil/graphite2","oracle/linux"],"epss":{"score":0.0227,"percentile":0.82931,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (2.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2016/dsa-3510","source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2016/dsa-3515","source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2016/dsa-3520","source":"security@mozilla.org"},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-37.html","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.securityfocus.com/bid/84222","source":"security@mozilla.org"},{"url":"http://www.securitytracker.com/id/1035215","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2917-1","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2917-2","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2917-3","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2927-1","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2934-1","source":"security@mozilla.org"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1243464","tags":["Issue Tracking"],"source":"security@mozilla.org"},{"url":"https://security.gentoo.org/glsa/201605-06","source":"security@mozilla.org"},{"url":"https://security.gentoo.org/glsa/201701-63","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2016/dsa-3510","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2016/dsa-3515","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2016/dsa-3520","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-37.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/84222","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1035215","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2917-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2917-2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2917-3","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2927-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2934-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1243464","tags":["Issue Tracking"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201605-06","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201701-63","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-2790","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}