CVE-2016-1960: mozilla firefox
Vulnerability summary
CVE-2016-1960 is a high (CVSS 8.8) vulnerability in mozilla firefox. EPSS estimates a 30.95% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 2 public exploits are recorded.
Weaponized exploit (exploit-database, 16-03-2018)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 16 · Related 10Timeline
- 13-03-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
30.95%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 30.95% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundFirefox 44.0.2 - ASM.JS JIT-Spray Remote Code Execution
Maturity: weaponized
Mozilla Firefox < 45.0 - 'nsHtml5TreeBuilder' Use-After-Free (EMET 5.52 Bypass)
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Mozilla2 products
- firefox≤ 44.0.2 | 38.0 | 38.0.1 | 38.0.5 | 38.1.0 | 38.1.1 | 38.2.0 | 38.2.1 | 38.3.0 | 38.4.0 | 38.5.0 | 38.5.1 | 38.6.0 | 38.6.1
- thunderbird≤ 38.6.0
Ubuntu2 products
- firefox< 45.0+build2-0ubuntu0.14.04.1
- thunderbird< 1:38.7.2+build1-0ubuntu0.14.04.1 | < 1:38.7.2+build1-0ubuntu0.16.04.1
Debian1 product
- firefox-esr< 45.0esr-1
Oracle1 product
- linuxEOL5.0 | 6 | 7
Suse1 product
- linux_enterprise12.0
6 vendors · 9 products
References
31 links- lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
Show all 31 references
- lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory