Search for vulnerabilities
Vulnerability details: VCID-ndf2-cp9s-c3cz
Vulnerability ID VCID-ndf2-cp9s-c3cz
Aliases CVE-2016-1960
Summary Security researcher ca0nguyen, working with HP's Zero Day Initiative, reported a use-after-free issue in the HTML5 string parser when parsing a particular set of table-related tags in a foreign fragment context such as SVG. This results in a potentially exploitable crash. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts.
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.87699 https://api.first.org/data/v1/epss?cve=CVE-2016-1960
epss 0.87699 https://api.first.org/data/v1/epss?cve=CVE-2016-1960
epss 0.87699 https://api.first.org/data/v1/epss?cve=CVE-2016-1960
epss 0.87699 https://api.first.org/data/v1/epss?cve=CVE-2016-1960
epss 0.87699 https://api.first.org/data/v1/epss?cve=CVE-2016-1960
epss 0.87699 https://api.first.org/data/v1/epss?cve=CVE-2016-1960
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2016-23
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-1960.json
https://api.first.org/data/v1/epss?cve=CVE-2016-1960
1315576 https://bugzilla.redhat.com/show_bug.cgi?id=1315576
CVE-2016-1960 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1960
CVE-2016-1960 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/42484.html
mfsa2016-23 https://www.mozilla.org/en-US/security/advisories/mfsa2016-23
RHSA-2016:0373 https://access.redhat.com/errata/RHSA-2016:0373
RHSA-2016:0460 https://access.redhat.com/errata/RHSA-2016:0460
USN-2917-1 https://usn.ubuntu.com/2917-1/
USN-2934-1 https://usn.ubuntu.com/2934-1/
Data source Exploit-DB
Date added Aug. 18, 2017
Description Mozilla Firefox < 45.0 - 'nsHtml5TreeBuilder' Use-After-Free (EMET 5.52 Bypass)
Ransomware campaign use Unknown
Source publication date Aug. 18, 2017
Exploit type remote
Platform windows
Source update date Aug. 18, 2017
Exploit Prediction Scoring System (EPSS)
Percentile 0.99429
EPSS Score 0.87699
Published At Aug. 15, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:12.116671+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2016/mfsa2016-23.md 37.0.0