{"id":"CVE-2016-1960","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-1960","generatedAt":"2026-11-05T05:35:27.708Z","title":"Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging…","description":"Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.","published":"2016-03-13T18:59:10.000Z","lastModified":"2026-06-17T00:42:58.000Z","status":"Modified","sourceIdentifier":"security@mozilla.org","cvss":{"version":"3.0","score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":[],"affected":["oracle/linux","mozilla/firefox","mozilla/thunderbird","opensuse/leap","opensuse/opensuse","suse/linux enterprise"],"epss":{"score":0.30946,"percentile":0.98265,"date":"2026-11-04","history":[{"date":"2026-09-21","score":0.26748,"percentile":0.97983},{"date":"2026-09-22","score":0.30946,"percentile":0.98178}]},"kev":{"listed":false},"exploits":{"count":2,"verified":true,"firstPublished":"2017-08-18","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44294,"kind":"exploit","title":"Firefox 44.0.2 - ASM.JS JIT-Spray Remote Code Execution","url":"https://www.exploit-db.com/exploits/44294","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/44294.html","file":"exploits/windows/remote/44294.html","published":"2018-03-16","added":"2018-03-16","updated":"2018-03-20","author":"Rh0","type":"remote","platform":"windows","port":null,"verified":true,"codes":["CVE-2017-5375","CVE-2016-1960"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comFirefoxSetup44.0.2.exe","screenshotUrl":"http://www.exploit-db.com/screenshots/idlt44500/screen-shot-2018-03-16-at-191222.png","referenceUrl":null},{"edbId":42484,"kind":"exploit","title":"Mozilla Firefox < 45.0 - 'nsHtml5TreeBuilder' Use-After-Free (EMET 5.52 Bypass)","url":"https://www.exploit-db.com/exploits/42484","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/42484.html","file":"exploits/windows/remote/42484.html","published":"2017-08-18","added":"2017-08-18","updated":"2017-08-18","author":"Hans Jerry Illikainen","type":"remote","platform":"windows","port":null,"verified":false,"codes":["CVE-2016-1960"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 30.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2016/dsa-3510","source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2016/dsa-3520","source":"security@mozilla.org"},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-23.html","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.securitytracker.com/id/1035215","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2917-1","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2917-2","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2917-3","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2934-1","source":"security@mozilla.org"},{"url":"http://zerodayinitiative.com/advisories/ZDI-16-198/","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1246014","tags":["Issue Tracking"],"source":"security@mozilla.org"},{"url":"https://security.gentoo.org/glsa/201605-06","source":"security@mozilla.org"},{"url":"https://www.exploit-db.com/exploits/42484/","source":"security@mozilla.org"},{"url":"https://www.exploit-db.com/exploits/44294/","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2016/dsa-3510","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2016/dsa-3520","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-23.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1035215","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2917-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2917-2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2917-3","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2934-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://zerodayinitiative.com/advisories/ZDI-16-198/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1246014","tags":["Issue Tracking"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201605-06","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/42484/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44294/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-1960","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}