Vulnerability Description
The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | <= 44.0.2 |
| Mozilla | Thunderbird | <= 38.6.0 |
| Oracle | Linux | 5.0 |
| Opensuse | Leap | 42.1 |
| Opensuse | Opensuse | 13.1 |
| Suse | Linux Enterprise | 12.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.htmlThird Party Advisory
- http://www.debian.org/security/2016/dsa-3510
- http://www.debian.org/security/2016/dsa-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-34.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.hThird Party Advisory
FAQ
What is CVE-2016-1974?
CVE-2016-1974 is a vulnerability with a CVSS score of 8.8 (HIGH). The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute ...
How severe is CVE-2016-1974?
CVE-2016-1974 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-1974?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Thunderbird, Oracle Linux, Opensuse Leap, Opensuse Opensuse.