CVE-2016-9063

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-90645.9Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who couCVE-2016-90657.5The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake CVE-2016-90667.5A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data.CVE-2016-90676.5Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.CVE-2016-90687.5A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This vulnerability affects CVE-2016-90697.8A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. This vulnerability afCVE-2016-90708.0A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScripCVE-2016-90715.3Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a uCVE-2016-90727.5When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabled by default. Note:CVE-2016-90737.5WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affectsCVE-2016-90745.9An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security SerCVE-2016-90759.8An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions l
CVE-2016-9063: Critical severity, CVSS 9.8 | Vulnix