CVE-2016-5258

8.8HIGH

Key Information:

Vendor
Oracle
Status
Linux
Vendor
CVE Published:
5 August 2016

Summary

Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.

References

http://www.debian.org/security/2016/dsa-3640
vendor-advisoryx_refsource_DEBIAN
https://bugzilla.mozilla.org/show_bug.cgi?id=1279146
x_refsource_CONFIRM
http://www.securitytracker.com/id/1036508
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.