Search for vulnerabilities
Vulnerability details: VCID-fbup-v86f-97ex
Vulnerability ID VCID-fbup-v86f-97ex
Aliases CVE-2016-2801
Summary Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
epss 0.00787 https://api.first.org/data/v1/epss?cve=CVE-2016-2801
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2016-37
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2801.json
https://api.first.org/data/v1/epss?cve=CVE-2016-2801
1315795 https://bugzilla.redhat.com/show_bug.cgi?id=1315795
CVE-2016-2801 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2801
mfsa2016-37 https://www.mozilla.org/en-US/security/advisories/mfsa2016-37
RHSA-2016:0373 https://access.redhat.com/errata/RHSA-2016:0373
RHSA-2016:0460 https://access.redhat.com/errata/RHSA-2016:0460
USN-2917-1 https://usn.ubuntu.com/2917-1/
USN-2927-1 https://usn.ubuntu.com/2927-1/
USN-2934-1 https://usn.ubuntu.com/2934-1/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.72878
EPSS Score 0.00787
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:12.904850+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2016/mfsa2016-37.md 37.0.0