CVE-2016-5277

EUVD-2016-6228
Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 84%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
≤ 48.0.2
mozillafirefox
45.1.0
mozillafirefox
45.1.1
mozillafirefox
45.2.0
mozillafirefox
45.3.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
firefox-esr
bookworm
115.14.0esr-1~deb12u1
fixed
bookworm (security)
128.4.0esr-1~deb12u1
fixed
bullseye
115.14.0esr-1~deb11u1
fixed
bullseye (security)
128.4.0esr-1~deb11u1
fixed
sid
128.4.0esr-1
fixed
trixie
128.3.1esr-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
precise
Fixed 49.0+build4-0ubuntu0.12.04.1
released
trusty
Fixed 49.0+build4-0ubuntu0.14.04.1
released
xenial
Fixed 49.0+build4-0ubuntu0.16.04.1
released
yakkety
Fixed 49.0+build4-0ubuntu2
released
thunderbird
precise
Fixed 1:45.4.0+build1-0ubuntu0.12.04.1
released
trusty
Fixed 1:45.4.0+build1-0ubuntu0.14.04.1
released
xenial
Fixed 1:45.4.0+build1-0ubuntu0.16.04.1
released
yakkety
Fixed 1:45.4.0+build1-0ubuntu0.16.10.1
released
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2016-1912.html
http://www.debian.org/security/2016/dsa-3674
http://www.mozilla.org/security/announce/2016/mfsa2016-85.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
http://www.securityfocus.com/bid/93049
http://www.securitytracker.com/id/1036852
https://bugzilla.mozilla.org/show_bug.cgi?id=1291665
https://security.gentoo.org/glsa/201701-15
https://www.mozilla.org/security/advisories/mfsa2016-86/
https://www.mozilla.org/security/advisories/mfsa2016-88/
http://rhn.redhat.com/errata/RHSA-2016-1912.html
http://www.debian.org/security/2016/dsa-3674
http://www.mozilla.org/security/announce/2016/mfsa2016-85.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
http://www.securityfocus.com/bid/93049
http://www.securitytracker.com/id/1036852
https://bugzilla.mozilla.org/show_bug.cgi?id=1291665
https://security.gentoo.org/glsa/201701-15
https://www.mozilla.org/security/advisories/mfsa2016-86/
https://www.mozilla.org/security/advisories/mfsa2016-88/