{"id":"CVE-2016-1951","aliases":["DEBIAN-CVE-2016-1951","DLA-513-1","DSA-3687-1","EUVD-2016-3040","GHSA-2xc9-w6jv-x92w","UBUNTU-CVE-2016-1951","USN-3023-1","USN-3028-1"],"status":"published","title":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12...","description":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.","severity":{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03126,"percentile":0.87949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2016-06-10T00:00:00Z","modified":"2026-09-22T07:01:02Z","fixes":[{"ecosystem":"Debian:12","package":"firefox-esr","fixed_in":["45.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"firefox-esr","fixed_in":["45.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"firefox-esr","fixed_in":["45.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nspr","fixed_in":["2:4.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nspr","fixed_in":["2:4.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nspr","fixed_in":["2:4.12-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"nspr","fixed_in":["2:4.9.2-1+deb7u4"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"nspr","fixed_in":["2:4.12-1+debu8u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nspr","fixed_in":["2:4.12-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","fixed_in":["1:45.2.0+build1-0ubuntu0.14.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"nspr","fixed_in":["2:4.12-0ubuntu0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","fixed_in":["1:45.2.0+build1-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.0esr-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.0esr-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.0esr-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.12-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9.2-1+deb7u4"}]}],"versions":["2:4.9.2-1","2:4.9.2-1+deb7u1","2:4.9.2-1+deb7u2","2:4.9.2-1+deb7u3"]},{"source":"osv","ecosystem":"Debian:8","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.12-1+debu8u1"}]}],"versions":["2:4.10.10-1","2:4.10.7-1","2:4.10.7-1+deb8u1","2:4.10.7-1+x32","2:4.10.8-1","2:4.10.8-2","2:4.10.9-1","2:4.10.9-2","2:4.11-1","2:4.12-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.12-0ubuntu0.14.04.1"}]}],"versions":["2:4.9.5-1ubuntu1","2:4.9.5-1ubuntu2","2:4.10.2-1ubuntu1","2:4.10.2-1ubuntu1.1","2:4.10.7-0ubuntu0.14.04.1","2:4.10.10-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:45.2.0+build1-0ubuntu0.14.04.3"}]}],"versions":["1:24.0+build1-0ubuntu1","1:24.0+build1-0ubuntu2","1:24.1.1+build1-0ubuntu0.13.10.1","1:24.1.1+build1-0ubuntu1","1:24.2.0+build1-0ubuntu1","1:24.4.0+build1-0ubuntu1","1:24.5.0+build1-0ubuntu0.14.04.1","1:24.6.0+build1-0ubuntu0.14.04.1","1:31.0+build1-0ubuntu0.14.04.1","1:31.1.1+build1-0ubuntu0.14.04.1","1:31.1.2+build1-0ubuntu0.14.04.1","1:31.2.0+build2-0ubuntu0.14.04.1","1:31.3.0+build1-0ubuntu0.14.04.1","1:31.4.0+build1-0ubuntu0.14.04.1","1:31.5.0+build1-0ubuntu0.14.04.1","1:31.6.0+build1-0ubuntu0.14.04.1","1:31.7.0+build1-0ubuntu0.14.04.1","1:31.8.0+build1-0ubuntu0.14.04.1","1:38.2.0+build1-0ubuntu0.14.04.1","1:38.3.0+build1-0ubuntu0.14.04.1","1:38.4.0+build3-0ubuntu0.14.04.1","1:38.5.1+build2-0ubuntu0.14.04.1","1:38.6.0+build1-0ubuntu0.14.04.1","1:38.7.2+build1-0ubuntu0.14.04.1","1:38.8.0+build1-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.12-0ubuntu0.16.04.1"}]}],"versions":["2:4.10.8-2ubuntu1","2:4.10.10-1ubuntu1","2:4.11-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:45.2.0+build1-0ubuntu0.16.04.1"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1","1:38.6.0+build1-0ubuntu1","1:38.7.2+build1-0ubuntu0.16.04.1","1:38.8.0+build1-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:45.2.0+build1-0ubuntu0.14.04.3"}]}],"versions":["1:24.0+build1-0ubuntu1","1:24.0+build1-0ubuntu2","1:24.1.1+build1-0ubuntu0.13.10.1","1:24.1.1+build1-0ubuntu1","1:24.2.0+build1-0ubuntu1","1:24.4.0+build1-0ubuntu1","1:24.5.0+build1-0ubuntu0.14.04.1","1:24.6.0+build1-0ubuntu0.14.04.1","1:31.0+build1-0ubuntu0.14.04.1","1:31.1.1+build1-0ubuntu0.14.04.1","1:31.1.2+build1-0ubuntu0.14.04.1","1:31.2.0+build2-0ubuntu0.14.04.1","1:31.3.0+build1-0ubuntu0.14.04.1","1:31.4.0+build1-0ubuntu0.14.04.1","1:31.5.0+build1-0ubuntu0.14.04.1","1:31.6.0+build1-0ubuntu0.14.04.1","1:31.7.0+build1-0ubuntu0.14.04.1","1:31.8.0+build1-0ubuntu0.14.04.1","1:38.2.0+build1-0ubuntu0.14.04.1","1:38.3.0+build1-0ubuntu0.14.04.1","1:38.4.0+build3-0ubuntu0.14.04.1","1:38.5.1+build2-0ubuntu0.14.04.1","1:38.6.0+build1-0ubuntu0.14.04.1","1:38.7.2+build1-0ubuntu0.14.04.1","1:38.8.0+build1-0ubuntu0.14.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:45.2.0+build1-0ubuntu0.16.04.1"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1","1:38.6.0+build1-0ubuntu1","1:38.7.2+build1-0ubuntu0.16.04.1","1:38.8.0+build1-0ubuntu0.16.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.12-0ubuntu0.14.04.1"}]}],"versions":["2:4.9.5-1ubuntu1","2:4.9.5-1ubuntu2","2:4.10.2-1ubuntu1","2:4.10.2-1ubuntu1.1","2:4.10.7-0ubuntu0.14.04.1","2:4.10.10-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.12-0ubuntu0.16.04.1"}]}],"versions":["2:4.10.8-2ubuntu1","2:4.10.10-1ubuntu1","2:4.11-1ubuntu1"]}],"products":[{"vendor":"mozilla","product":"netscape_portable_runtime"}],"references":[{"url":"https://groups.google.com/forum/message/raw?msg=mozilla.dev.tech.nspr/dV4MyMsg6jw/hhWcXOgJDQAJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"http://www.securityfocus.com/bid/92385","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1036590","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://hg.mozilla.org/projects/nspr/rev/96381e3aaae2","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1174015","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://www.ubuntu.com/usn/USN-3023-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1951"},{"url":"https://github.com/advisories/GHSA-2xc9-w6jv-x92w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1951","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1951","tags":["report"]},{"url":"https://groups.google.com/forum/#!topic/mozilla.dev.tech.nspr/dV4MyMsg6jw","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3028-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3023-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2818","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1951","description":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.","status":"published","published":"2016-08-07T19:00:00Z","modified":"2024-08-05T23:10:40.392Z","updated_at":"2026-11-02T14:33:35.841056Z"}],"euvd":[{"id":"EUVD-2016-3040","description":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.","status":"published","published":"2016-08-07T19:00:00Z","modified":"2024-08-05T23:10:40Z","updated_at":"2026-11-03T02:22:55.100655Z"}],"ghsa":[{"id":"GHSA-2xc9-w6jv-x92w","title":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12...","description":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.","status":"published","published":"2022-05-17T03:43:00Z","modified":"2023-01-27T05:07:37Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:43:09.288496Z"}],"nvd":[{"id":"CVE-2016-1951","description":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.","status":"published","published":"2016-08-07T19:59:00.127Z","modified":"2026-06-17T00:42:55.55Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"CVE-2016-1951","description":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.","status":"published","published":"2016-08-07T19:59:00.127Z","modified":"2026-03-15T14:16:27.774319Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1951","description":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.","status":"published","published":"2016-08-07T19:59:00.127Z","modified":"2026-09-22T07:01:02.093607857Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1951","description":"Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.","status":"published","published":"2016-06-10T00:00:00Z","modified":"2026-04-22T10:34:43.096439Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-513-1","title":"nspr - security update","status":"published","published":"2016-06-12T00:00:00Z","modified":"2026-03-09T02:10:03.6722Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3687-1","title":"nspr - security update","status":"published","published":"2016-10-05T00:00:00Z","modified":"2026-03-09T01:22:05.98089Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"USN-3023-1","title":"thunderbird vulnerabilities","description":"It was discovered that NSPR incorrectly handled memory allocation. If a\nuser were tricked in to opening a specially crafted message, an attacker\ncould potentially exploit this to cause a denial of service via\napplication crash, or execute arbitrary code. (CVE-2016-1951)\n\nChristian Holler, Gary Kwong, Jesse Ruderman, Tyson Smith, Timothy Nikkel,\nSylvestre Ledru, Julian Seward, Olli Pettay, and Karl Tomlinson,\ndiscovered multiple memory safety issues in Thunderbird. If a user were\ntricked in to opening a specially crafted message, an attacker could\npotentially exploit these to cause a denial of service via application\ncrash, or execute arbitrary code. (CVE-2016-2818)\n","status":"published","published":"2016-07-18T15:31:45Z","modified":"2026-04-22T09:25:59.984181Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3028-1","title":"nspr vulnerability","description":"It was discovered that NSPR incorrectly handled memory allocation. A remote\nattacker could use this issue to cause NSPR to crash, resulting in a denial\nof service, or possibly execute arbitrary code.\n","status":"published","published":"2016-07-11T16:28:56Z","modified":"2026-04-22T09:26:26.786632Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}