Security researcher Samuel Groß reported an integer overflow error in WebSockets during data buffering on incoming packets when an allocated buffer is resized incorrectly. This results in the buffer array holding the data being shrunk, instead of grown, resulting in attacker controlled data being written at a known offset from the newly allocated buffer. This results in a potentially exploitable crash. External Reference: https://www.mozilla.org/security/advisories/mfsa2016-75/ https://www.mozilla.org/security/advisories/mfsa2016-86/ Acknowledgements: Name: the Mozilla project Upstream: Samuel Groß
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Via RHSA-2016:1912 https://rhn.redhat.com/errata/RHSA-2016-1912.html