Bug 1361986 (CVE-2016-5261)

Summary: CVE-2016-5261 Mozilla: Integer overflow and memory corruption in WebSocketChannel (MFSA 2016-75, MFSA 2016-86)
Product: [Other] Security Response Reporter: Huzaifa S. Sidhpurwala <huzaifas>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: security-response-team, sisharma
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-23 05:33:28 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1360577, 1369653    

Description Huzaifa S. Sidhpurwala 2016-08-01 06:33:26 UTC 
Security researcher Samuel Groß reported an integer overflow error in WebSockets during data buffering on incoming packets when an allocated buffer is resized incorrectly. This results in the buffer array holding the data being shrunk, instead of grown, resulting in attacker controlled data being written at a known offset from the newly allocated buffer. This results in a potentially exploitable crash. 


External Reference:

https://www.mozilla.org/security/advisories/mfsa2016-75/
https://www.mozilla.org/security/advisories/mfsa2016-86/


Acknowledgements:

Name: the Mozilla project
Upstream: Samuel Groß
Comment 1 errata-xmlrpc 2016-09-21 07:49:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2016:1912 https://rhn.redhat.com/errata/RHSA-2016-1912.html