CVE-2016-1951 Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified othe...
HighCVSS 8.6
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 45.0esr-1 | 45.0esr-1 |
| debian/firefox-esr(Debian:13) | < 45.0esr-1 | 45.0esr-1 |
| debian/firefox-esr(Debian:14) | < 45.0esr-1 | 45.0esr-1 |
| debian/nspr(Debian:12) | < 2:4.12-1 | 2:4.12-1 |
| debian/nspr(Debian:13) | < 2:4.12-1 | 2:4.12-1 |
| debian/nspr(Debian:14) | < 2:4.12-1 | 2:4.12-1 |
| mozilla netscape portable runtime | <= 4.11 | No fix listed |
References
- Debian Security Tracker CVE-2016-1951 vendor-advisory
- 92385 vdb-entry
- 1036590 vdb-entry
- USN-3023-1 vendor-advisory
- bugzilla.mozilla.org issue-tracking
- [dev-tech-nspr] 20160217 [ANNOUNCE] NSPR 4.12 Release mailing-list
- hg.mozilla.org