Explain CVE-2016-1960
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2016:0894', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2016/mfsa2016-23.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1246014'}, {'name': 'SUSE-SU-2016:0820', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html'}, {'name': 'openSUSE-SU-2016:1767', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'name': 'openSUSE-SU-2016:0731', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html'}, {'name': 'SUSE-SU-2016:0727', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html'}, {'name': 'openSUSE-SU-2016:1778', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.html'}, {'name': 'openSUSE-SU-2016:0876', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html'}, {'name': 'USN-2917-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2917-1'}, {'name': 'DSA-3520', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3520'}, {'name': 'openSUSE-SU-2016:1769', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.html'}, {'name': '44294', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44294/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://zerodayinitiative.com/advisories/ZDI-16-198/'}, {'name': 'SUSE-SU-2016:0909', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html'}, {'name': 'DSA-3510', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3510'}, {'name': 'openSUSE-SU-2016:0733', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html'}, {'name': '1035215', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035215'}, {'name': 'SUSE-SU-2016:0777', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html'}, {'name': 'GLSA-201605-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201605-06'}, {'name': 'USN-2934-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2934-1'}, {'name': '42484', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/42484/'}, {'name': 'USN-2917-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2917-2'}, {'name': 'USN-2917-3', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2917-3'}]
CVE State: PUBLISHED