CVEvulnerability

CVE-2016-1960

8.8 HIGH Published 2016-03-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-03-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.

Affected configurations

• oracle linux 5.0 • oracle linux 6 • oracle linux 7 • mozilla firefox (<= 44.0.2) • mozilla firefox 38.0 • mozilla firefox 38.0.1 • mozilla firefox 38.0.5 • mozilla firefox 38.1.0 • mozilla firefox 38.1.1 • mozilla firefox 38.2.0 • mozilla firefox 38.2.1 • mozilla firefox 38.3.0 • mozilla firefox 38.4.0 • mozilla firefox 38.5.0 • mozilla firefox 38.5.1 • mozilla firefox 38.6.0 • mozilla firefox 38.6.1 • mozilla thunderbird (<= 38.6.0) • opensuse leap 42.1 • opensuse opensuse 13.1 • opensuse opensuse 13.2 • suse linux enterprise 12.0

References