Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-5258

Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.

Published

2016-08-05T01:59:14.063

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-416
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System oracle linux 5.0 Yes
Operating System oracle linux 6 Yes
Operating System oracle linux 7 Yes
Application mozilla firefox ≤ 47.0.1 Yes
Application mozilla firefox 45.1.0 Yes
Application mozilla firefox 45.1.1 Yes
Application mozilla firefox 45.2.0 Yes
Application mozilla firefox 45.3.0 Yes
References