PT-2016-1455 · Mozilla+5 · Firefox Esr+6

Dominique Hazaël-Massieux

·

Publicado

2016-03-08

·

Atualizado

2024-12-12

·

CVE-2016-1962

CVSS v2.0

10

Crítica

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 45.0 Mozilla Firefox ESR versions prior to 38.7
Description The issue is related to a use-after-free vulnerability in the mozilla::DataChannelConnection::Close function, which can be exploited by remote attackers to execute arbitrary code. This is achieved by mishandling WebRTC data-channel connections. The vulnerability allows an attacker to leverage the incorrect usage of WebRTC, potentially leading to the execution of arbitrary code.
Recommendations For Mozilla Firefox versions prior to 45.0, update to version 45.0 or later. For Mozilla Firefox ESR versions prior to 38.7, update to version 38.7 or later.

Correção

Use After Free

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

ALT-PU-2016-1277
ALT-PU-2016-1454
BDU:2016-00756
CESA-2016_0373
CVE-2016-1962
DSA-3510-1
DSA-3520-1
MGASA-2016-0105
OPENSUSE-SU-2016_0731-1
OPENSUSE-SU-2016_0733-1
OPENSUSE-SU-2016_0876-1
OPENSUSE-SU-2016_0894-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:10230-1
OPENSUSE-SU-2024:14572-1
RHSA-2016:0373
RHSA-2016_0373
SUSE-SU-2016:0727-1
SUSE-SU-2016:0777-1
SUSE-SU-2016:0909-1
USN-2917-1
USN-2917-2
USN-2917-3

Produtos afetados

Alt Linux
Centos
Firefox
Firefox Esr
Red Hat
Suse
Ubuntu