CVE-2016-9080

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Memory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 50.1

References

http://www.securityfocus.com/bid/94883Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037461Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1289701%2C1314401%2C1315848Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2016-94/Vendor Advisory
http://www.securityfocus.com/bid/94883Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037461Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1289701%2C1314401%2C1315848Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2016-94/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-90819.8Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account CVE-2016-90825.5Integer overflow in the write_png function in cairo 1.14.6 allows remote attackers to cause a denial of service (invalid pointer dereference CVE-2016-90837.8drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of s CVE-2016-90847.8drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denia CVE-2016-90853.3Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.CVE-2016-90866.5GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this CVE-2016-90879.8SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allo CVE-2016-90917.2Blue Coat Advanced Secure Gateway (ASG) 6.6 before 6.6.5.4 and Content Analysis System (CAS) 1.3 before 1.3.7.4 are susceptible to an OS com CVE-2016-90928.8The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) 1.1 management consoles are susceptible to a cro CVE-2016-90937.0A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-i CVE-2016-90947.8Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs CVE-2016-90977.2The Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 p