CVE search · CVE-2016-9063

CVE-2016-9063

critical 9.8

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.

Open in the NVD CVE.org JSON

Status: Modified
Published: 2018-06-11
Last changed: 2026-10-08
Source: security@mozilla.org
Weakness: CWE-190

Severity

Version	Score	Vector	Source
CVSS 3.1	critical 9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`	nvd@nist.govPrimary
CVSS 2.0	high 7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`	nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

mozilla · firefox
debian · debian_linux
python · python

References

http://www.securityfocus.com/bid/94337Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037298Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039427Third Party AdvisoryVDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1274777Issue TrackingVendor Advisory
https://www.debian.org/security/2017/dsa-3898Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2016-89/Vendor Advisory
http://www.securityfocus.com/bid/94337Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037298Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039427Third Party AdvisoryVDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1274777Issue TrackingVendor Advisory
https://www.debian.org/security/2017/dsa-3898Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2016-89/Vendor Advisory