CVE-2016-1960 Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause....
HighCVSS 8.8
EPSS 30.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 45.0esr-1 | 45.0esr-1 |
| debian/firefox-esr(Debian:13) | < 45.0esr-1 | 45.0esr-1 |
| debian/firefox-esr(Debian:14) | < 45.0esr-1 | 45.0esr-1 |
| oracle linux | = 5.0 | No fix listed |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| mozilla Firefox | <= 44.0.2 | No fix listed |
| mozilla Firefox | = 38.0 | No fix listed |
| mozilla Firefox | = 38.0.1 | No fix listed |
| mozilla Firefox | = 38.0.5 | No fix listed |
| mozilla Firefox | = 38.1.0 | No fix listed |
| mozilla Firefox | = 38.1.1 | No fix listed |
| mozilla Firefox | = 38.2.0 | No fix listed |
| mozilla Firefox | = 38.2.1 | No fix listed |
| mozilla Firefox | = 38.3.0 | No fix listed |
| mozilla Firefox | = 38.4.0 | No fix listed |
| mozilla Firefox | = 38.5.0 | No fix listed |
| mozilla Firefox | = 38.5.1 | No fix listed |
| mozilla Firefox | = 38.6.0 | No fix listed |
| mozilla Firefox | = 38.6.1 | No fix listed |
| mozilla Thunderbird | <= 38.6.0 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise | = 12.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-1960 vendor-advisory
- SUSE-SU-2016:0727 vendor-advisory
- openSUSE-SU-2016:0731 vendor-advisory
- openSUSE-SU-2016:0733 vendor-advisory
- SUSE-SU-2016:0777 vendor-advisory
- SUSE-SU-2016:0820 vendor-advisory
- openSUSE-SU-2016:0876 vendor-advisory
- openSUSE-SU-2016:0894 third-party-advisory vendor-advisory
- SUSE-SU-2016:0909 vendor-advisory
- openSUSE-SU-2016:1767 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1769 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1778 third-party-advisory vendor-advisory
- DSA-3510 vendor-advisory
- DSA-3520 vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com third-party-advisory
- 1035215 vdb-entry
- USN-2917-1 vendor-advisory
- USN-2917-2 vendor-advisory
- USN-2917-3 vendor-advisory
- USN-2934-1 vendor-advisory
- zerodayinitiative.com third-party-advisory
- bugzilla.mozilla.org issue-tracking
- GLSA-201605-06 vendor-advisory
- 42484 exploit
- 44294 exploit