Login Request a demo
High severity · published Mar 13, 2016
CVE-2016-1950
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR…
8.8
CVSS
4.2%
EPSS
No
On KEV
Description
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firefox · Mozilla
through 44.0.2; 38.0; 38.0.1; 38.0.5; 38.1.0; 38.1.1; +8 more · source: NVD
IO
iOS · Apple
through 9.2.1 · source: NVD
GS
Glassfish Server · Oracle
2.1.1 · source: NVD
IW
Iplanet Web Proxy Server · Oracle
4.0 · source: NVD
IW
Iplanet Web Server · Oracle
7.0 · source: NVD
LI
Linux · Oracle
5.0; 6; 7; 5.0; 6; 7 · source: NVD
MO
Mac OS X · Apple
through 10.11.3 · source: NVD
NS
Network Security Services · Mozilla
3.19.2; 3.20; 3.20.1; 3.21 · source: NVD
OP
Opensuse · Opensuse
13.1 · source: NVD
TV
Tvos · Apple
through 9.1 · source: NVD
VS
VM Server · Oracle
3.2 · source: NVD
WA
Watchos · Apple
through 2.1 · source: NVD
Affected product
IO
iOS
Apple
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-1950
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-1950
Mailing List
http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
Mailing List
http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
Mailing List
http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
Mailing List
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html
More from iOS
10.0
CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
9.8
CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability
9.8
CVE-2025-31201
Apple Multiple Products Arbitrary Read and Write Vulnerability