Vulnerability Description
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Linux | 5.0 |
| Mozilla | Firefox | <= 44.0.2 |
| Mozilla | Thunderbird | <= 38.6.0 |
| Opensuse | Leap | 42.1 |
| Opensuse | Opensuse | 13.1 |
| Suse | Linux Enterprise | 12.0 |
References
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.htmlThird Party Advisory
- http://www.debian.org/security/2016/dsa-3510
- http://www.debian.org/security/2016/dsa-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-23.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.hThird Party Advisory
FAQ
What is CVE-2016-1960?
CVE-2016-1960 is a vulnerability with a CVSS score of 8.8 (HIGH). Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause ...
How severe is CVE-2016-1960?
CVE-2016-1960 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-1960?
Check the references section above for vendor advisories and patch information. Affected products include: Oracle Linux, Mozilla Firefox, Mozilla Thunderbird, Opensuse Leap, Opensuse Opensuse.