CVE-2016-1960

NameCVE-2016-1960
DescriptionInteger underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-3510-1, DSA-3520-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firefox (PTS)sid103.0-1fixed
firefox-esr (PTS)buster78.14.0esr-1~deb10u1fixed
buster (security)91.12.0esr-1~deb10u1fixed
bullseye91.11.0esr-1~deb11u1fixed
bullseye (security)91.12.0esr-1~deb11u1fixed
bookworm91.11.0esr-1fixed
sid91.12.0esr-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firefoxsource(unstable)45.0-1
firefox-esrsource(unstable)45.0esr-1
icedovesourcewheezy38.7.0-1~deb7u1DSA-3520-1
icedovesourcejessie38.7.0-1~deb8u1DSA-3520-1
icedovesource(unstable)38.7.0-1
iceweaselsourcewheezy38.7.0esr-1~deb7u1DSA-3510-1
iceweaselsourcejessie38.7.0esr-1~deb8u1DSA-3510-1
iceweaselsource(unstable)(unfixed)

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2016-23/

Search for package or bug name: Reporting problems