Vulnerability Details : CVE-2016-1952
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Vulnerability category: Memory CorruptionExecute codeDenial of service
Products affected by CVE-2016-1952
- cpe:2.3:a:novell:suse_package_hub_for_suse_linux_enterprise:12:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-1952
1.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-1952
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2016-1952
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-1952
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html
[security-announce] openSUSE-SU-2016:0894-1: important: Security updateThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2934-1
USN-2934-1: Thunderbird vulnerabilities | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html
[security-announce] openSUSE-SU-2016:0876-1: important: Security update
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html
[security-announce] openSUSE-SU-2016:1769-1: important: Security updateThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html
[security-announce] SUSE-SU-2016:0909-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html
[security-announce] openSUSE-SU-2016:1778-1: important: Security updateThird Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1241217
Bugzilla.mozilla.org is offlineIssue Tracking
-
http://www.ubuntu.com/usn/USN-2917-1
USN-2917-1: Firefox vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-2917-3
USN-2917-3: Firefox regressions | Ubuntu security notices
-
http://www.securitytracker.com/id/1035215
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Spoof the Address Bar, Overwrite Files, and Deny Service - SecurityTracker
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html
[security-announce] SUSE-SU-2016:0777-1: important: Security update for
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1244250
Bugzilla.mozilla.org is offlineIssue Tracking
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1224979
TreeStatusIssue Tracking
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html
[security-announce] SUSE-SU-2016:0820-1: important: Security update for
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Oracle Linux Bulletin - January 2016Third Party Advisory
-
https://security.gentoo.org/glsa/201605-06
Mozilla Products: Multiple vulnerabilities (GLSA 201605-06) — Gentoo security
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1123661
Bugzilla.mozilla.org is offlineIssue Tracking
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1244995
Bugzilla.mozilla.org is offlineIssue Tracking
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html
[security-announce] openSUSE-SU-2016:0731-1: important: Security update
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1249685
Bugzilla.mozilla.org is offlineIssue Tracking
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1221872
TreeStatusIssue Tracking
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
[security-announce] openSUSE-SU-2016:0733-1: important: Security update
-
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html
[security-announce] openSUSE-SU-2016:1767-1: important: Security updateThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2917-2
USN-2917-2: Firefox regressions | Ubuntu security notices
-
http://www.debian.org/security/2016/dsa-3510
Debian -- Security Information -- DSA-3510-1 iceweasel
-
http://www.mozilla.org/security/announce/2016/mfsa2016-16.html
Miscellaneous memory safety hazards (rv:45.0 / rv:38.7) — MozillaVendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html
[security-announce] SUSE-SU-2016:0727-1: important: Security update for
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1234578
Bugzilla.mozilla.org is offlineIssue Tracking
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1242279
Bugzilla.mozilla.org is offlineIssue Tracking
Jump to