CVE-2016-1960
published 2016-03-13CVE-2016-1960: Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote…
PriorityP260high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
30.95%
98.1th percentile
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 45.0-1 (sid) | firefox 45.0-1 (sid) |
| debian | firefox-esr | < firefox 45.0-1 (sid) | firefox 45.0-1 (sid) |
| mozilla | firefox | <= 44.0.2 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 45.0+build2-0ubuntu0.14.04.1 | 45.0+build2-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 45.0.2+build1-0ubuntu0.14.04.1 | 45.0.2+build1-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 45.0.1+build1-0ubuntu0.14.04.2 | 45.0.1+build1-0ubuntu0.14.04.2 |
| mozilla | thunderbird | <= 38.6.0 | — |
| mozilla | thunderbird | >= 0 < 1:38.7.2+build1-0ubuntu0.14.04.1 | 1:38.7.2+build1-0ubuntu0.14.04.1 |
| mozilla | thunderbird | >= 0 < 1:38.7.2+build1-0ubuntu0.16.04.1 | 1:38.7.2+build1-0ubuntu0.16.04.1 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit triggers via innerHTML assignment of a table containing an SVG element in a foreign fragment context — monitor for DOM mutations combining <table> and <svg> end-tag mismatches in HTML5 parser input. ↗
- →Exploit uses a large Uint32Array heap spray (0x19000000 elements) to occupy high heap addresses for fake nsHtml5StackNode objects — anomalously large typed-array allocations in Firefox JS heap are a detection signal. ↗
- →Exploit uses asm.js JIT-spray to place attacker-controlled shellcode at a predictable fixed address (0x3c3c1dc8 / 0xXXXX1dc8) — repeated instantiation of identical asm.js modules (0x1800 regions) is a strong indicator. ↗
- →Exploit pivots stack to heap via xchg edi, esp gadget before calling WinExec('calc.exe') — ROP chain ending in WinExec/ShellExecute with a process name argument on the heap is a behavioral detection opportunity. ↗
- →Exploit searches for ROP gadgets within the loaded PE text section of xul.dll and kernel32.dll at runtime — unusual memory-read patterns scanning executable sections of these DLLs from JS heap addresses may indicate exploitation. ↗
- →Exploit overwrites vftable entries of an HTMLDivElement (entries 2 and 131) and calls elem.click() to trigger code execution — hooking or monitoring vftable pointer writes to DOM element objects can detect this technique. ↗
- →Exploit targets Firefox versions before 45.0 and ESR before 38.7 — presence of Firefox 44.0.2 or earlier on a host should be flagged as vulnerable to CVE-2016-1960. ↗
- ·The nsHtml5StackNode size (0x1c bytes) is hardcoded in the exploit and may vary across Firefox builds — the exploit notes this as a sizeof estimate. ↗
- ·The asm.js JIT-spray technique relies on the absence of constant folding in Release builds (present in Firefox 44.0.2); Nightly builds after ~30 Nov 2016 added constant folding which partially mitigates this spray vector. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2016-04-27·CVSS 8.8
CVE-2016-1950 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the privileges of the user invoking Thunderbird. (CVE-2016-1952)
Nicolas Golubovic discovered that CSP violation reports can be used to
overwrite local files. If a user were tricked in to opening a specially
crafted website in a browsing context with addon signing disabled and
unpacked addons installed, an attacker could potentially exp
Ubuntu
Firefox regressions
vendor_ubuntu·2016-04-19·CVSS 8.8
[HIGH] Firefox regressions
Title: Firefox regressions
Summary: USN-2917-1 introduced several regressions in Firefox.
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
web compatibility regressions.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini,
Ubuntu
Firefox regressions
vendor_ubuntu·2016-04-07·CVSS 8.8
[HIGH] Firefox regressions
Title: Firefox regressions
Summary: USN-2917-1 introduced several regressions in Firefox.
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
regressions that could result in search engine settings being lost, the
list of search providers appearing empty or the location bar breaking
after typing an invalid URL. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian H
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2016-03-09·CVSS 8.8
CVE-2016-1950 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could p
Red Hat
Mozilla: Use-after-free in HTML5 string parser (MFSA 2016-23)
vendor_redhat·2016-03-08·CVSS 8.8
CVE-2016-1960 [HIGH] Mozilla: Use-after-free in HTML5 string parser (MFSA 2016-23)
Mozilla: Use-after-free in HTML5 string parser (MFSA 2016-23)
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
Debian
CVE-2016-1960: firefox - Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in ...
vendor_debian·2016·CVSS 8.8
CVE-2016-1960 [HIGH] CVE-2016-1960: firefox - Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in ...
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
Scope: local
sid: resolved (fixed in 45.0-1)
GHSA
GHSA-hhgc-88w2-v4mx: Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45
ghsa_unreviewed·2022-05-13
CVE-2016-1960 [HIGH] GHSA-hhgc-88w2-v4mx: Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
OSV
thunderbird vulnerabilities
osv·2016-04-27·CVSS 8.8
CVE-2016-1952 [HIGH] thunderbird vulnerabilities
thunderbird vulnerabilities
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the privileges of the user invoking Thunderbird. (CVE-2016-1952)
Nicolas Golubovic discovered that CSP violation reports can be used to
overwrite local files. If a user were tricked in to opening a specially
crafted website in a browsing context with addon signing disabled and
unpacked addons installed, an attacker could potentially exploit this to
gain additional privileges. (CVE-2016-1954)
Jose Marti
OSV
firefox regressions
osv·2016-04-19·CVSS 8.8
[HIGH] firefox regressions
firefox regressions
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
web compatibility regressions.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple
memory safety issues in Firefox.
OSV
firefox regressions
osv·2016-04-07·CVSS 8.8
[HIGH] firefox regressions
firefox regressions
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
regressions that could result in search engine settings being lost, the
list of search providers appearing empty or the location bar breaking
after typing an invalid URL. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup,
OSV
CVE-2016-1960: Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45
osv·2016-03-13·CVSS 8.8
CVE-2016-1960 [HIGH] CVE-2016-1960: Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
OSV
firefox vulnerabilities
osv·2016-03-09·CVSS 8.8
CVE-2016-1950 [HIGH] firefox vulnerabilities
firefox vulnerabilities
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the
No detection rules found.
Exploit-DB
Firefox 44.0.2 - ASM.JS JIT-Spray Remote Code Execution
exploitdb·2018-03-16·CVSS 8.8
CVE-2017-5375 [HIGH] Firefox 44.0.2 - ASM.JS JIT-Spray Remote Code Execution
Firefox 44.0.2 - ASM.JS JIT-Spray Remote Code Execution
---
46.0.1
-->
CVE-2016-1960 and ASM.JS JIT-Spray
"use strict"
var Exploit = function(){
this.asmjs = new Asmjs()
this.heap = new Heap()
}
Exploit.prototype.go = function(){
/* target address of fake node object */
var node_target_addr = 0x20200000
/* target address of asm.js float pool payload*/
var target_eip = 0x3c3c1dc8
/* spray fake Node objects */
this.heap.spray(node_target_addr, target_eip)
/* spray asm.js float constant pools */
this.asmjs.spray_float_payload(0x1800)
/* go! */
this.trigger_vuln(node_target_addr)
};
Exploit.prototype.trigger_vuln = function(node_ptr){
document.body.innerHTML = ''
this.heap.gc()
var a = new Array()
for (var i=0; i td';
*/
/* easier to exploit codepath */
document.getElementById(
Exploit-DB
Mozilla Firefox < 45.0 - 'nsHtml5TreeBuilder' Use-After-Free (EMET 5.52 Bypass)
exploitdb·2017-08-18·CVSS 8.8
CVE-2016-1960 [HIGH] Mozilla Firefox < 45.0 - 'nsHtml5TreeBuilder' Use-After-Free (EMET 5.52 Bypass)
Mozilla Firefox
CVE-2016-1960
/*
* Exploit Title: Mozilla Firefox .
*
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1246014
* [2] https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/en-US/
*/
"use strict";
/* This is executed after having pivoted the stack. `esp' points to a
* region on the heap, and the original stack pointer is stored in
* `edi'. In order to bypass EMET, the shellcode should make sure to
* xchg edi, esp before any protected function is called.
*
* For convenience, the first two "arguments" to the shellcode is a
* module handle for kernel32.dll and the address of GetProcAddress() */
const shellcode = [
"\x8b\x84\x24\x04\x00\x00\x00", /* mov eax, dword [esp + 0x4] */
"\x8b\x8c\x24\x08\x00\x00\x00", /* mov ecx, dword [esp + 0x8] */
"\x87\xe7", /* xchg edi, e
Bugzilla
lack of executable-code quota allows full bypass of ASLR and DEP
bugzilla·2016-12-21
[CRITICAL] lack of executable-code quota allows full bypass of ASLR and DEP
lack of executable-code quota allows full bypass of ASLR and DEP
Created attachment 8820887
PoC for Firefox 50.1.0 (Release). Demonstrates point 2.1 in the report
asm.js allows to JIT-spray attacker controlled code, and hence, allows to fully
bypass ASLR and DEP in 32-bit (x86) Firefox (Tested versions: Release and
Nightly). As it is very easy to find, I do not know if it is already known (I
hope I do not reinvent the wheel here...)
In summary this means, that an attacker can exploit a memory corruption
vulnerability (such as an UAF) as if no ASLR and DEP existed. He only needs EIP
control and does not need any memory disclosures/info-leaks or code-reuse. That
makes exploitation of memory corruptions for an attacker super easy.
Consider following asm.js script:
function asm_js_modul
Bugzilla
CVE-2016-1960 Mozilla: Use-after-free in HTML5 string parser (MFSA 2016-23)
bugzilla·2016-03-08·CVSS 8.8
CVE-2016-1960 [HIGH] CVE-2016-1960 Mozilla: Use-after-free in HTML5 string parser (MFSA 2016-23)
CVE-2016-1960 Mozilla: Use-after-free in HTML5 string parser (MFSA 2016-23)
Security researcher ca0nguyen, working with HP's Zero Day Initiative, reported a use-after-free issue in the HTML5 string parser when parsing a particular set of table-related tags in a foreign fragment context such as SVG. This results in a potentially exploitable crash.
External Reference:
https://www.mozilla.org/security/announce/2016/mfsa2016-23.html
Acknowledgements:
Name: the Mozilla project
Upstream: ca0nguyen
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 5
Via RHSA-2016:0373 https://rhn.redhat.com/errata/RHSA-2016-0373.html
---
This issue has been addressed in the following products:
Red Hat E
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.htmlhttp://www.debian.org/security/2016/dsa-3510http://www.debian.org/security/2016/dsa-3520http://www.mozilla.org/security/announce/2016/mfsa2016-23.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securitytracker.com/id/1035215http://www.ubuntu.com/usn/USN-2917-1http://www.ubuntu.com/usn/USN-2917-2http://www.ubuntu.com/usn/USN-2917-3http://www.ubuntu.com/usn/USN-2934-1http://zerodayinitiative.com/advisories/ZDI-16-198/https://bugzilla.mozilla.org/show_bug.cgi?id=1246014https://security.gentoo.org/glsa/201605-06https://www.exploit-db.com/exploits/42484/https://www.exploit-db.com/exploits/44294/http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00008.htmlhttp://www.debian.org/security/2016/dsa-3510http://www.debian.org/security/2016/dsa-3520http://www.mozilla.org/security/announce/2016/mfsa2016-23.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securitytracker.com/id/1035215http://www.ubuntu.com/usn/USN-2917-1http://www.ubuntu.com/usn/USN-2917-2http://www.ubuntu.com/usn/USN-2917-3http://www.ubuntu.com/usn/USN-2934-1http://zerodayinitiative.com/advisories/ZDI-16-198/https://bugzilla.mozilla.org/show_bug.cgi?id=1246014https://security.gentoo.org/glsa/201605-06https://www.exploit-db.com/exploits/42484/https://www.exploit-db.com/exploits/44294/
2016-03-13
Published