CVE-2016-1938

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-01-31 · updated 2026-06-17
Weakness: CWE-310

Description

The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.

Affected products

Mozilla Firefox: through 43.0.4
Mozilla NSS: through 3.20.1
openSUSE Leap: 42.1
Opensuse: 13.1, 13.2

References

http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00010.html
http://www.debian.org/security/2016/dsa-3688
http://www.mozilla.org/security/announce/2016/mfsa2016-07.html
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
http://www.securityfocus.com/bid/81955
http://www.securityfocus.com/bid/91787
http://www.securitytracker.com/id/1034825
http://www.ubuntu.com/usn/USN-2880-1
http://www.ubuntu.com/usn/USN-2880-2
http://www.ubuntu.com/usn/USN-2903-1

Get alerted when CVE-2016-1938 or the next vulnerability affects your stack