Denial of service in Mozilla products - CVE-2016-1954
Published: October 17, 2016 / Updated: May 26, 2020
Vulnerability identifier: #VU1018
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-1954
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to improper input validation. By convincing a victim to visit a malicious website, attackers can overwrite an add-on resource that may lead to denial of service or privilege escalation.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.
The weakness is due to improper input validation. By convincing a victim to visit a malicious website, attackers can overwrite an add-on resource that may lead to denial of service or privilege escalation.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.
Affected software
Oracle Linux
Oracle Solaris
Mozilla Thunderbird
Firefox ESR
Mozilla Firefox
Oracle Solaris
Mozilla Thunderbird
Firefox ESR
Mozilla Firefox
How to mitigate CVE-2016-1954
Update Firefox to version 45.
Update Firefox ESR to version 38.7.
Update Thunderbird to version 38.7 or 45.
Update Firefox ESR to version 38.7.
Update Thunderbird to version 38.7 or 45.