CVE-2016-1961

MEDIUM

Description

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.

References

http://hg.mozilla.org/releases/mozilla-release/rev/b208427885d3

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html

http://www.debian.org/security/2016/dsa-3510

http://www.debian.org/security/2016/dsa-3520

http://www.mozilla.org/security/announce/2016/mfsa2016-24.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.securitytracker.com/id/1035215

http://www.ubuntu.com/usn/USN-2917-1

http://www.ubuntu.com/usn/USN-2917-2

http://www.ubuntu.com/usn/USN-2917-3

http://www.ubuntu.com/usn/USN-2934-1

http://zerodayinitiative.com/advisories/ZDI-16-199/

https://bugzilla.mozilla.org/show_bug.cgi?id=1249377

https://security.gentoo.org/glsa/201605-06

Details

Source: MITRE

Published: 2016-03-13

Updated: 2019-12-27

Risk Information

CVSS v2.0

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 2.8

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to 44.0.2 (inclusive)

cpe:2.3:a:mozilla:firefox_esr:38.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.0.5:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.1.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.1.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.2.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.2.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.3.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.4.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.5.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.5.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.6.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.6.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions up to 38.6.0 (inclusive)

Configuration 3

OR

cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:*

cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*

cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*

Tenable Plugins

View all (33 total)

IDNameProductFamilySeverity
99765EulerOS 2.0 SP1 : firefox (EulerOS-SA-2016-1002)NessusHuawei Local Security Checks
critical
802023Firefox < 45 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
critical
91986openSUSE Security Update : Mozilla Thunderbird (openSUSE-2016-851)NessusSuSE Local Security Checks
critical
91985openSUSE Security Update : Mozilla Thunderbird (openSUSE-2016-848)NessusSuSE Local Security Checks
critical
91379GLSA-201605-06 : Mozilla Products: Multiple vulnerabilities (Logjam) (SLOTH)NessusGentoo Local Security Checks
critical
90822Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : thunderbird vulnerabilities (USN-2934-1)NessusUbuntu Local Security Checks
high
90598Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : firefox regressions (USN-2917-3)NessusUbuntu Local Security Checks
critical
9207Mozilla Firefox < 45.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
90421Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : firefox regressions (USN-2917-2)NessusUbuntu Local Security Checks
critical
90263SUSE SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2016:0909-1)NessusSuSE Local Security Checks
critical
90240openSUSE Security Update : MozillaThunderbird (openSUSE-2016-402)NessusSuSE Local Security Checks
critical
90170openSUSE Security Update : MozillaThunderbird (openSUSE-2016-395)NessusSuSE Local Security Checks
critical
90065SUSE SLES10 Security Update : MozillaFirefox (SUSE-SU-2016:0820-1)NessusSuSE Local Security Checks
critical
90031Debian DSA-3520-1 : icedove - security updateNessusDebian Local Security Checks
critical
89990SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2016:0777-1)NessusSuSE Local Security Checks
critical
89988Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20160316)NessusScientific Linux Local Security Checks
high
89986RHEL 5 / 6 / 7 : thunderbird (RHSA-2016:0460)NessusRed Hat Local Security Checks
high
89981Oracle Linux 6 / 7 : thunderbird (ELSA-2016-0460)NessusOracle Linux Local Security Checks
high
89971CentOS 5 / 6 / 7 : thunderbird (CESA-2016:0460)NessusCentOS Local Security Checks
high
89929SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2016:0727-1)NessusSuSE Local Security Checks
critical
89915openSUSE Security Update : Firefox (openSUSE-2016-334)NessusSuSE Local Security Checks
critical
89913openSUSE Security Update : MozillaFirefox / mozilla-nspr / mozilla-nss (openSUSE-2016-332)NessusSuSE Local Security Checks
critical
89875Firefox < 45 Multiple VulnerabilitiesNessusWindows
critical
89874Firefox ESR < 38.7 Multiple VulnerabilitiesNessusWindows
critical
89873Firefox < 45 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
89872Firefox ESR < 38.7 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
89826Ubuntu 12.04 LTS / 14.04 / 15.10 : firefox vulnerabilities (USN-2917-1)NessusUbuntu Local Security Checks
critical
89822Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20160309)NessusScientific Linux Local Security Checks
critical
89816Oracle Linux 5 / 6 / 7 : firefox (ELSA-2016-0373)NessusOracle Linux Local Security Checks
critical
89792Debian DSA-3510-1 : iceweasel - security updateNessusDebian Local Security Checks
critical
89774RHEL 5 / 6 / 7 : firefox (RHSA-2016:0373)NessusRed Hat Local Security Checks
critical
89765FreeBSD : mozilla -- multiple vulnerabilities (2225c5b4-1e5a-44fc-9920-b3201c384a15)NessusFreeBSD Local Security Checks
critical
89763CentOS 5 / 6 / 7 : firefox (CESA-2016:0373)NessusCentOS Local Security Checks
critical