CVE-2016-1960
High · 8.8CVSS
8.8
EPSS
30.9%
Published
Mar 13, 2016
CISA due date
—
The record
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | firefox-esr | 0 | 45.0esr-1 |
| Debian:12 | firefox-esr | 0 | 45.0esr-1 |
| Debian:13 | firefox-esr | 0 | 45.0esr-1 |
| Debian:7 | icedove | 0 | 38.7.0-1~deb7u1 |
| Debian:7 | iceweasel | 0 | 38.7.0esr-1~deb7u1 |
| Debian:8 | icedove | 0 | 38.7.0-1~deb8u1 |
| Debian:8 | iceweasel | 0 | 38.7.0esr-1~deb8u1 |
| Mageia:5 | firefox | 0 | 38.7.0-1.mga5 |
| Mageia:5 | firefox-l10n | 0 | 38.7.0-1.mga5 |
| Mageia:5 | nspr | 0 | 4.12-1.mga5 |
| Mageia:5 | nss | 0 | 3.21.1-1.mga5 |
| Mageia:5 | thunderbird | 0 | 38.7.0-1.mga5 |
| Mageia:5 | thunderbird-l10n | 0 | 38.7.0-1.mga5 |
| Red Hat:enterprise_linux:5::client | firefox | 0 | 0:38.7.0-1.el5_11 |
| Red Hat:enterprise_linux:5::client | firefox-debuginfo | 0 | 0:38.7.0-1.el5_11 |
| Red Hat:enterprise_linux:5::client | thunderbird | 0 | 0:38.7.0-1.el5_11 |
| Red Hat:enterprise_linux:5::client | thunderbird-debuginfo | 0 | 0:38.7.0-1.el5_11 |
| Red Hat:enterprise_linux:5::server | firefox | 0 | 0:38.7.0-1.el5_11 |
| Red Hat:enterprise_linux:5::server | firefox-debuginfo | 0 | 0:38.7.0-1.el5_11 |
| Red Hat:enterprise_linux:6::client | firefox | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::client | firefox-debuginfo | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::client | thunderbird | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::client | thunderbird-debuginfo | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::computenode | firefox | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::computenode | firefox-debuginfo | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::server | firefox | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::server | firefox-debuginfo | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::server | thunderbird | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::server | thunderbird-debuginfo | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::workstation | firefox | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::workstation | firefox-debuginfo | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::workstation | thunderbird | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:6::workstation | thunderbird-debuginfo | 0 | 0:38.7.0-1.el6_7 |
| Red Hat:enterprise_linux:7::client | firefox | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::client | firefox-debuginfo | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::client | thunderbird | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::client | thunderbird-debuginfo | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::server | firefox | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::server | firefox-debuginfo | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::server | thunderbird | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::server | thunderbird-debuginfo | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::workstation | firefox | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::workstation | firefox-debuginfo | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::workstation | thunderbird | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:enterprise_linux:7::workstation | thunderbird-debuginfo | 0 | 0:38.7.0-1.el7_2 |
| Red Hat:rhel_productivity:5 | thunderbird | 0 | 0:38.7.0-1.el5_11 |
| Red Hat:rhel_productivity:5 | thunderbird-debuginfo | 0 | 0:38.7.0-1.el5_11 |
| SUSE:Linux Enterprise Desktop 11 SP4 | MozillaFirefox | 0 | 38.7.0esr-37.3 |
| SUSE:Linux Enterprise Desktop 11 SP4 | mozilla-nspr | 0 | 4.12-24.1 |
| SUSE:Linux Enterprise Desktop 11 SP4 | mozilla-nss | 0 | 3.20.2-28.1 |
| SUSE:Linux Enterprise Desktop 12 | MozillaFirefox | 0 | 38.7.0esr-63.3 |
| SUSE:Linux Enterprise Desktop 12 | mozilla-nspr | 0 | 4.12-12.1 |
| SUSE:Linux Enterprise Desktop 12 | mozilla-nss | 0 | 3.20.2-40.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | MozillaFirefox | 0 | 38.7.0esr-63.3 |
| SUSE:Linux Enterprise Desktop 12 SP1 | mozilla-nspr | 0 | 4.12-12.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | mozilla-nss | 0 | 3.20.2-40.1 |
| SUSE:Linux Enterprise Server 11 SP2-LTSS | MozillaFirefox | 0 | 38.7.0esr-36.3 |
| SUSE:Linux Enterprise Server 11 SP2-LTSS | mozilla-nspr | 0 | 4.12-19.1 |
| SUSE:Linux Enterprise Server 11 SP2-LTSS | mozilla-nss | 0 | 3.20.2-20.1 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | MozillaFirefox | 0 | 38.7.0esr-37.3 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | mozilla-nspr | 0 | 4.12-24.1 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | mozilla-nss | 0 | 3.20.2-28.1 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | MozillaFirefox | 0 | 38.7.0esr-37.3 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | mozilla-nspr | 0 | 4.12-24.1 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | mozilla-nss | 0 | 3.20.2-28.1 |
| SUSE:Linux Enterprise Server 11 SP4 | MozillaFirefox | 0 | 38.7.0esr-37.3 |
| SUSE:Linux Enterprise Server 11 SP4 | mozilla-nspr | 0 | 4.12-24.1 |
| SUSE:Linux Enterprise Server 11 SP4 | mozilla-nss | 0 | 3.20.2-28.1 |
| SUSE:Linux Enterprise Server 12 | MozillaFirefox | 0 | 38.7.0esr-63.3 |
| SUSE:Linux Enterprise Server 12 | mozilla-nspr | 0 | 4.12-12.1 |
| SUSE:Linux Enterprise Server 12 | mozilla-nss | 0 | 3.20.2-40.1 |
| SUSE:Linux Enterprise Server 12 SP1 | MozillaFirefox | 0 | 38.7.0esr-63.3 |
| SUSE:Linux Enterprise Server 12 SP1 | mozilla-nspr | 0 | 4.12-12.1 |
| SUSE:Linux Enterprise Server 12 SP1 | mozilla-nss | 0 | 3.20.2-40.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | MozillaFirefox | 0 | 38.7.0esr-37.3 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | mozilla-nspr | 0 | 4.12-24.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | mozilla-nss | 0 | 3.20.2-28.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | MozillaFirefox | 0 | 38.7.0esr-63.3 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | mozilla-nspr | 0 | 4.12-12.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | mozilla-nss | 0 | 3.20.2-40.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | MozillaFirefox | 0 | 38.7.0esr-63.3 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | mozilla-nspr | 0 | 4.12-12.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | mozilla-nss | 0 | 3.20.2-40.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | MozillaFirefox | 0 | 38.7.0esr-37.3 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | mozilla-nspr | 0 | 4.12-24.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | mozilla-nss | 0 | 3.20.2-28.1 |
| SUSE:Linux Enterprise Software Development Kit 12 | MozillaFirefox | 0 | 38.7.0esr-63.3 |
| SUSE:Linux Enterprise Software Development Kit 12 | mozilla-nspr | 0 | 4.12-12.1 |
| SUSE:Linux Enterprise Software Development Kit 12 | mozilla-nss | 0 | 3.20.2-40.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | MozillaFirefox | 0 | 38.7.0esr-63.3 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | mozilla-nspr | 0 | 4.12-12.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | mozilla-nss | 0 | 3.20.2-40.1 |
| SUSE:Package Hub 12 | MozillaThunderbird | 0 | 45.2-6.1 |
| Ubuntu:14.04:LTS | firefox | 0 | 45.0+build2-0ubuntu0.14.04.1 |
| Ubuntu:14.04:LTS | thunderbird | 0 | 1:38.7.2+build1-0ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | firefox | 0 | 45.0+build2-0ubuntu1 |
| Ubuntu:16.04:LTS | thunderbird | 0 | 1:38.7.2+build1-0ubuntu0.16.04.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 50.1.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 45.5.1-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2025-0243 Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and… Also affects firefox-esr
- CVE-2025-0237 The WebChannel API, which is used to transport various information across processes, did… Also affects firefox-esr
- CVE-2025-0238 Assuming a controlled failed memory allocation, an attacker could have caused a… Also affects firefox-esr
- CVE-2025-0240 Parsing a JavaScript module as JSON could, under some circumstances, cause… Also affects firefox-esr
- CVE-2025-0239 When using Alt-Svc, ALPN did not properly validate certificates when the original server… Also affects firefox-esr
- CVE-2025-0241 When segmenting specially crafted text, segmentation would corrupt memory leading to a… Also affects firefox-esr
- CVE-2025-0242 Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox… Also affects firefox-esr
- CVE-2024-11704 A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when… Also affects firefox-esr