CVE-2016-5281
Mozilla: use-after-free in DOMSVGLength (MFSA 2016-85, MFSA 2016-86)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.
Vulnerabilidad de uso de memoria previamente liberada en la claseDOMSVGLength en Mozilla Firefox en versiones anteriores a la 49.0, Firefox ESR en versiones 45.x anteriores a la 45.4 y Thunderbird en versiones anteriores a la 45.4 permite que los atacantes remotos ejecuten código arbitrario utilizando la interacción errónea código JavaScript y un documento SVG.
Atte Kettunen discovered an out-of-bounds read when handling certain Content Security Policy directives in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash. Christoph Diehl, Christian Holler, Gary Kwong, Nathan Froyd, Honza Bambas, Seth Fowler, Michael Smith, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, and Carsten Book discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-06-03 CVE Reserved
- 2016-09-21 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://www.geeknik.net/7gr1u98b9 | Not Applicable | |
| http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html | X_refsource_confirm |
|
| http://www.securityfocus.com/bid/93049 | Vdb Entry | |
| http://www.securitytracker.com/id/1036852 | Vdb Entry | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1284690 | Issue Tracking | |
| https://www.mozilla.org/security/advisories/mfsa2016-86 | X_refsource_confirm | |
| https://www.mozilla.org/security/advisories/mfsa2016-88 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2016-1912.html | 2018-10-30 | |
| http://www.debian.org/security/2016/dsa-3674 | 2018-10-30 | |
| http://www.mozilla.org/security/announce/2016/mfsa2016-85.html | 2018-10-30 | |
| https://security.gentoo.org/glsa/201701-15 | 2018-10-30 | |
| https://access.redhat.com/security/cve/CVE-2016-5281 | 2016-09-21 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1377563 | 2016-09-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | <= 48.0.2 Search vendor "Mozilla" for product "Firefox" and version " <= 48.0.2" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 45.0.2 Search vendor "Mozilla" for product "Firefox" and version "45.0.2" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 45.0 Search vendor "Mozilla" for product "Firefox Esr" and version "45.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 45.0.1 Search vendor "Mozilla" for product "Firefox Esr" and version "45.0.1" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 45.1.1 Search vendor "Mozilla" for product "Firefox Esr" and version "45.1.1" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 45.2.0 Search vendor "Mozilla" for product "Firefox Esr" and version "45.2.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 45.3.0 Search vendor "Mozilla" for product "Firefox Esr" and version "45.3.0" | - |
Affected
| ||||||