PT-2016-4930 · Mozilla+2 · Network Security Services+3

Hanno Böck · Published 2016-01-26 · Updated 2024-12-12 · CVE-2016-1938

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services (NSS) versions prior to 3.21 Mozilla Firefox versions prior to 44.0

Description The issue is related to the improper division of numbers in the s mp div function, which might make it easier for remote attackers to defeat cryptographic protection mechanisms. This is achieved by leveraging the use of the mp div or mp exptmod function.

Recommendations For Mozilla Network Security Services (NSS) versions prior to 3.21, update to version 3.21 or later. For Mozilla Firefox versions prior to 44.0, update to version 44.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2016-1938

DLA-427-1

DLA-480-1

DSA-3688-1

OPENSUSE-SU-2016_0309-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2016:0334-1

SUSE-SU-2016:0338-1

SUSE-SU-2016:0584-1

USN-2880-1

USN-2880-2

USN-2903-1

USN-2973-1

Affected Products

Firefox

Network Security Services

Suse

Ubuntu

References · 2128

• 🔥 https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_div.c · Exploit
• 🔥 https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_exptmod.c · Exploit
• http://mozilla.org/security/announce/2016/mfsa2016-07.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2903-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1945 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1938 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0338-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1938 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1938 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1939 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-2880-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2805 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2973-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2880-2 · Vendor Advisory