CVE-2016-9063

high-risk
Published 2018-06-11

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.

Do I need to act?

~
2.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: ca079a3ea30098aff3197c559a0e32d42dda6d84, 17bf6b4671ec02d80ad29b278639d5307baddeb5, 7dc38385ce78c5c04637531c4325a83b57fbeb3a, 3f568389763c205f8779ad75f2cf44ab9782608e, 5fd33b5926eb8c9352bf5718369b4a8d72c4bb44
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

Debian Mozilla Python

References (12)

Third Party Advisory http://www.securityfocus.com/bid/94337
Third Party Advisory http://www.securitytracker.com/id/1037298
Third Party Advisory http://www.securitytracker.com/id/1039427
Issue Tracking https://bugzilla.mozilla.org/show_bug.cgi?id=1274777
Third Party Advisory https://www.debian.org/security/2017/dsa-3898
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2016-89/
Third Party Advisory http://www.securityfocus.com/bid/94337
Third Party Advisory http://www.securitytracker.com/id/1037298
Third Party Advisory http://www.securitytracker.com/id/1039427
Issue Tracking https://bugzilla.mozilla.org/show_bug.cgi?id=1274777
Third Party Advisory https://www.debian.org/security/2017/dsa-3898
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2016-89/
50
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 6/34 · Minimal
Exposure 12/34 · Low