CVE-2016-1966
published 2016-03-13CVE-2016-1966: The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote…
PriorityP339high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
2.93%
85.5th percentile
The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 45.0-1 (sid) | firefox 45.0-1 (sid) |
| debian | firefox-esr | < firefox 45.0-1 (sid) | firefox 45.0-1 (sid) |
| mozilla | firefox | <= 44.0.2 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 45.0+build2-0ubuntu0.14.04.1 | 45.0+build2-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 45.0.2+build1-0ubuntu0.14.04.1 | 45.0.2+build1-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 45.0.1+build1-0ubuntu0.14.04.2 | 45.0.1+build1-0ubuntu0.14.04.2 |
| mozilla | thunderbird | <= 38.6.0 | — |
| mozilla | thunderbird | >= 0 < 1:38.7.2+build1-0ubuntu0.14.04.1 | 1:38.7.2+build1-0ubuntu0.14.04.1 |
| mozilla | thunderbird | >= 0 < 1:38.7.2+build1-0ubuntu0.16.04.1 | 1:38.7.2+build1-0ubuntu0.16.04.1 |
| opensuse | opensuse | — | — |
| oracle | linux | — | — |
| oracle | linux | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m8wx-7rr9-rfp5: The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime
ghsa_unreviewed·2022-05-13
CVE-2016-1966 [HIGH] GHSA-m8wx-7rr9-rfp5: The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime
The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
OSV
thunderbird vulnerabilities
osv·2016-04-27·CVSS 8.8
CVE-2016-1952 [HIGH] thunderbird vulnerabilities
thunderbird vulnerabilities
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the privileges of the user invoking Thunderbird. (CVE-2016-1952)
Nicolas Golubovic discovered that CSP violation reports can be used to
overwrite local files. If a user were tricked in to opening a specially
crafted website in a browsing context with addon signing disabled and
unpacked addons installed, an attacker could potentially exploit this to
gain additional privileges. (CVE-2016-1954)
Jose Marti
OSV
firefox regressions
osv·2016-04-19·CVSS 8.8
[HIGH] firefox regressions
firefox regressions
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
web compatibility regressions.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple
memory safety issues in Firefox.
OSV
firefox regressions
osv·2016-04-07·CVSS 8.8
[HIGH] firefox regressions
firefox regressions
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
regressions that could result in search engine settings being lost, the
list of search providers appearing empty or the location bar breaking
after typing an invalid URL. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup,
OSV
CVE-2016-1966: The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime
osv·2016-03-13·CVSS 8.8
CVE-2016-1966 [HIGH] CVE-2016-1966: The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime
The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
OSV
firefox vulnerabilities
osv·2016-03-09·CVSS 8.8
CVE-2016-1950 [HIGH] firefox vulnerabilities
firefox vulnerabilities
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2016-04-27·CVSS 8.8
CVE-2016-1950 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory
safety issues in Thunderbird. If a user were tricked in to opening a
specially crafted message, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary code
with the privileges of the user invoking Thunderbird. (CVE-2016-1952)
Nicolas Golubovic discovered that CSP violation reports can be used to
overwrite local files. If a user were tricked in to opening a specially
crafted website in a browsing context with addon signing disabled and
unpacked addons installed, an attacker could potentially exp
Ubuntu
Firefox regressions
vendor_ubuntu·2016-04-19·CVSS 8.8
[HIGH] Firefox regressions
Title: Firefox regressions
Summary: USN-2917-1 introduced several regressions in Firefox.
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
web compatibility regressions.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini,
Ubuntu
Firefox regressions
vendor_ubuntu·2016-04-07·CVSS 8.8
[HIGH] Firefox regressions
Title: Firefox regressions
Summary: USN-2917-1 introduced several regressions in Firefox.
USN-2917-1 fixed vulnerabilities in Firefox. This update caused several
regressions that could result in search engine settings being lost, the
list of search providers appearing empty or the location bar breaking
after typing an invalid URL. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian H
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2016-03-09·CVSS 8.8
CVE-2016-1950 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2016-1950)
Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel
Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto,
Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could p
Red Hat
Mozilla: Memory corruption with malicious NPAPI plugin (MFSA 2016-31)
vendor_redhat·2016-03-08·CVSS 8.8
CVE-2016-1966 [HIGH] Mozilla: Memory corruption with malicious NPAPI plugin (MFSA 2016-31)
Mozilla: Memory corruption with malicious NPAPI plugin (MFSA 2016-31)
The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
Debian
CVE-2016-1966: firefox - The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp ...
vendor_debian·2016·CVSS 8.8
CVE-2016-1966 [HIGH] CVE-2016-1966: firefox - The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp ...
The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
Scope: local
sid: resolved (fixed in 45.0-1)
No detection rules found.
No public exploits indexed.
http://hg.mozilla.org/releases/mozilla-release/rev/f0d2911a9a4ehttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.htmlhttp://www.debian.org/security/2016/dsa-3510http://www.debian.org/security/2016/dsa-3520http://www.mozilla.org/security/announce/2016/mfsa2016-31.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securitytracker.com/id/1035215http://www.ubuntu.com/usn/USN-2917-1http://www.ubuntu.com/usn/USN-2917-2http://www.ubuntu.com/usn/USN-2917-3http://www.ubuntu.com/usn/USN-2934-1https://bugzilla.mozilla.org/show_bug.cgi?id=1246054https://security.gentoo.org/glsa/201605-06http://hg.mozilla.org/releases/mozilla-release/rev/f0d2911a9a4ehttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.htmlhttp://www.debian.org/security/2016/dsa-3510http://www.debian.org/security/2016/dsa-3520http://www.mozilla.org/security/announce/2016/mfsa2016-31.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securitytracker.com/id/1035215http://www.ubuntu.com/usn/USN-2917-1http://www.ubuntu.com/usn/USN-2917-2http://www.ubuntu.com/usn/USN-2917-3http://www.ubuntu.com/usn/USN-2934-1https://bugzilla.mozilla.org/show_bug.cgi?id=1246054https://security.gentoo.org/glsa/201605-06
2016-03-13
Published