CVEvulnerability
CVE-2016-1938
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-01-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-310
Description
The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.
Affected configurations
• opensuse leap 42.1
• opensuse opensuse 13.1
• opensuse opensuse 13.2
• mozilla nss (<= 3.20.1)
• mozilla firefox (<= 43.0.4)
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00010.html lists.opensuse.org
- http://www.debian.org/security/2016/dsa-3688 www.debian.org
- http://www.mozilla.org/security/announce/2016/mfsa2016-07.html Vendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Third Party Advisory
- http://www.securityfocus.com/bid/81955 www.securityfocus.com
- http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034825 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2880-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2880-2 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2903-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2903-2 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2973-1 www.ubuntu.com
- https://blog.fuzzing-project.org/37-Mozilla-NSS-Wrong-calculation-results-in-mp_div-and-mp_exptmod.html blog.fuzzing-project.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=1190248 Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194947 Issue Tracking
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21_release_notes Vendor Advisory
- https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_div.c github.com
- https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_exptmod.c github.com
- https://hg.mozilla.org/projects/nss/diff/a555bf0fc23a/lib/freebl/mpi/mpi.c hg.mozilla.org
- https://security.gentoo.org/glsa/201605-06 security.gentoo.org
- https://security.gentoo.org/glsa/201701-46 security.gentoo.org
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00010.html lists.opensuse.org
- http://www.debian.org/security/2016/dsa-3688 www.debian.org
- http://www.mozilla.org/security/announce/2016/mfsa2016-07.html Vendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Third Party Advisory
- http://www.securityfocus.com/bid/81955 www.securityfocus.com
- http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034825 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2880-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2880-2 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2903-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2903-2 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2973-1 www.ubuntu.com
- https://blog.fuzzing-project.org/37-Mozilla-NSS-Wrong-calculation-results-in-mp_div-and-mp_exptmod.html blog.fuzzing-project.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=1190248 Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194947 Issue Tracking
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21_release_notes Vendor Advisory
- https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_div.c github.com
- https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_exptmod.c github.com
- https://hg.mozilla.org/projects/nss/diff/a555bf0fc23a/lib/freebl/mpi/mpi.c hg.mozilla.org
- https://security.gentoo.org/glsa/201605-06 security.gentoo.org
- https://security.gentoo.org/glsa/201701-46 security.gentoo.org