CVE-2016-1938
Summary
| CVE | CVE-2016-1938 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2016-01-31 18:59:00 UTC |
|---|
| Updated | 2018-10-30 16:27:00 UTC |
|---|
| Description | The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Errors in mp_div and mp_exptmod cryptographic functions in NSS — Mozilla |
CONFIRM |
www.mozilla.org |
Vendor Advisory |
| [security-announce] openSUSE-SU-2016:0306-1: important: Security update |
SUSE |
lists.opensuse.org |
Third Party Advisory |
| 1190248 - (CVE-2016-1938) mp_div and mp_exptmod sometimes produce wrong calculation results |
CONFIRM |
bugzilla.mozilla.org |
Issue Tracking |
| Oracle Critical Patch Update - July 2016 |
CONFIRM |
www.oracle.com |
Third Party Advisory |
| bignum-fuzz/CVE-2016-1938-nss-mp_exptmod.c at master · hannob/bignum-fuzz · GitHub |
MISC |
github.com |
|
| USN-2880-2: Firefox regression | Ubuntu |
UBUNTU |
www.ubuntu.com |
|
| Oracle July 2016 Critical Patch Update Multiple Vulnerabilities |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| [security-announce] SUSE-SU-2016:0338-1: important: Security update for |
SUSE |
lists.opensuse.org |
|
| nss: diff lib/freebl/mpi/mpi.c |
CONFIRM |
hg.mozilla.org |
|
| Mozilla Products: Multiple vulnerabilities (GLSA 201605-06) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| [security-announce] openSUSE-SU-2016:0309-1: important: Security update |
SUSE |
lists.opensuse.org |
Third Party Advisory |
| NSS 3.21 release notes - Mozilla | MDN |
MISC |
developer.mozilla.org |
Vendor Advisory |
| USN-2973-1: Thunderbird vulnerabilities | Ubuntu |
UBUNTU |
www.ubuntu.com |
|
| USN-2903-2: NSS regression | Ubuntu |
UBUNTU |
www.ubuntu.com |
|
| Debian -- Security Information -- DSA-3688-1 nss |
DEBIAN |
www.debian.org |
|
| USN-2903-1: NSS vulnerability | Ubuntu |
UBUNTU |
www.ubuntu.com |
|
| Mozilla Network Security Service (NSS): Multiple vulnerabilities (GLSA 201701-46) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| Mozilla Network Security Services CVE-2016-1938 Weak Encryption Multiple Security Weaknesses |
BID |
www.securityfocus.com |
|
| Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Spoof the Address Bar, Bypass Security Restrictions, and Deny Service - SecurityTracker |
SECTRACK |
www.securitytracker.com |
|
| 1194947 - miscalculation in mp_exptmod() |
CONFIRM |
bugzilla.mozilla.org |
Issue Tracking |
| USN-2880-1: Firefox vulnerabilities | Ubuntu |
UBUNTU |
www.ubuntu.com |
|
| bignum-fuzz/CVE-2016-1938-nss-mp_div.c at master · hannob/bignum-fuzz · GitHub |
MISC |
github.com |
|
| Mozilla NSS: Wrong calculation results in mp_div() and mp_exptmod() | The Fuzzing Project |
MISC |
blog.fuzzing-project.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 710518 Gentoo Linux Mozilla Network Security Service (NSS) Multiple Vulnerabilities (GLSA 201701-46)
