CVE-2016-1930: mozilla firefox

Modified

AliasesUBUNTU-CVE-2016-1930

Published 31-01-2016Last modified 05-08-2024

Vulnerability summary

CVE-2016-1930 is a high (CVSS 10.0) vulnerability in mozilla firefox. EPSS estimates a 5.99% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 6% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

5.99%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 14 · Related 8

DSA-3457-1 DSA-3491-1 MGASA-2016-0041 MGASA-2016-0078 OPENSUSE-SU-2024:10071-1 OPENSUSE-SU-2024:10230-1+8 more

Timeline

31-01-2016
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.09.8v2.010.0

EPSS trend

Probability

5.99%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.99% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Opensuse2 products

leapEOL42.1
opensuseEOL13.1 | 13.2

Ubuntu2 products

firefox< 44.0+build3-0ubuntu0.14.04.1
thunderbird< 1:38.6.0+build1-0ubuntu0.14.04.1

Mozilla1 product

firefox≤ 43.0.4 | 38.0 | 38.1.0 | 38.2.0 | 38.3.0 | 38.4.0 | 38.5.0

Oracle1 product

linuxEOL5.0 | 6 | 7

4 vendors · 6 products

References

35 links

www.debian.org/security/2016/dsa-3457Vendor AdvisoryX Refsource DEBIAN
www.debian.org/security/2016/dsa-3491Vendor AdvisoryX Refsource DEBIAN
bugzilla.mozilla.org/show_bug.cgi?id=1234571X Refsource CONFIRMIssue Tracking
lists.opensuse.org/opensuse-updates/2016-02/msg00105.htmlVendor AdvisoryX Refsource SUSE
bugzilla.mozilla.org/show_bug.cgi?id=1223670X Refsource CONFIRMIssue Tracking
www.securitytracker.com/id/1034825VDB EntryX Refsource SECTRACK
bugzilla.mozilla.org/show_bug.cgi?id=1234280X Refsource CONFIRMIssue Tracking
bugzilla.mozilla.org/show_bug.cgi?id=1221385X Refsource CONFIRMIssue Tracking
www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-0071.htmlVendor AdvisoryX Refsource REDHAT

Show all 35 references

www.ubuntu.com/usn/USN-2880-1Vendor AdvisoryX Refsource UBUNTU
www.mozilla.org/security/announce/2016/mfsa2016-01.htmlX Refsource CONFIRMVendor Advisory
www.ubuntu.com/usn/USN-2880-2Vendor AdvisoryX Refsource UBUNTU
bugzilla.mozilla.org/show_bug.cgi?id=1224200X Refsource CONFIRMIssue Tracking
bugzilla.mozilla.org/show_bug.cgi?id=1233152X Refsource CONFIRMIssue Tracking
bugzilla.mozilla.org/show_bug.cgi?id=1230668X Refsource CONFIRMIssue Tracking
rhn.redhat.com/errata/RHSA-2016-0258.htmlVendor AdvisoryX Refsource REDHAT
lists.opensuse.org/opensuse-security-announce/2016-02/msg00010.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.ubuntu.com/usn/USN-2904-1Vendor AdvisoryX Refsource UBUNTU
bugzilla.mozilla.org/show_bug.cgi?id=1230639X Refsource CONFIRMIssue Tracking
www.securityfocus.com/bid/81953VDB EntryX Refsource BID
bugzilla.mozilla.org/show_bug.cgi?id=1230686X Refsource CONFIRMIssue Tracking
security.gentoo.org/glsa/201605-06Vendor AdvisoryX Refsource GENTOO
lists.opensuse.org/opensuse-updates/2016-02/msg00101.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-02/msg00003.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
bugzilla.mozilla.org/show_bug.cgi?id=1233346X Refsource CONFIRMIssue Tracking
bugzilla.mozilla.org/show_bug.cgi?id=1230483X Refsource CONFIRMIssue Tracking
bugzilla.mozilla.org/show_bug.cgi?id=1233925X Refsource CONFIRMIssue Tracking
ubuntu.com/security/CVE-2016-1930REPORT
www.mozilla.org/en-US/security/advisories/mfsa2016-01/REPORT
ubuntu.com/security/notices/USN-2880-1Advisory
ubuntu.com/security/notices/USN-2904-1Advisory
www.cve.org/CVERecord?id=CVE-2016-1930REPORT