Home > Vulnerability Database > CVE-2016-1938

Mend.io Vulnerability Database

CVE-2016-1938

Date: January 31, 2016

The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.

Language: C

Severity Score

6.5

Related Resources (27)

Url: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Url: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html

Url: https://access.redhat.com/security/cve/CVE-2016-1938

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2016-1938

Url: http://www.debian.org/security/2016/dsa-3688

Url: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00010.html

Url: http://www.ubuntu.com/usn/USN-2973-1

Url: https://security.gentoo.org/glsa/201605-06

Url: https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_div.c

Url: https://hg.mozilla.org/projects/nss/diff/a555bf0fc23a/lib/freebl/mpi/mpi.c

Url: https://security.gentoo.org/glsa/201701-46

Url: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html

Url: http://www.ubuntu.com/usn/USN-2880-1

Url: http://www.ubuntu.com/usn/USN-2880-2

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=1190248

Url: http://www.securityfocus.com/bid/81955

Url: http://www.securityfocus.com/bid/91787

Url: http://www.ubuntu.com/usn/USN-2903-2

Url: http://www.securitytracker.com/id/1034825

Url: http://www.ubuntu.com/usn/USN-2903-1

Url: https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_exptmod.c

Url: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21_release_notes

Url: http://www.mozilla.org/security/announce/2016/mfsa2016-07.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2016-1938

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=1194947

Url: https://blog.fuzzing-project.org/37-Mozilla-NSS-Wrong-calculation-results-in-mp_div-and-mp_exptmod.html

Url: https://www.mend.io/vulnerability-database/CVE-2016-1938

Severity Score

6.5

Weakness Type (CWE)

Cryptographic Issues

CWE-310

CVSS v3.1

Base Score:	6.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	6.4
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2016-1938

Date: January 31, 2016

Language: C

Severity Score

Related Resources (27)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?