CVE-2016-5259

Low

Low Medium High Critical

CVSS Score

Published: Aug 05, 2016

Last Modified: Apr 12, 2025

Vulnerability Description

Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.

Known Affected Software

7 configuration(s) from 2 vendor(s)

firefox

Version:

45.1.0

CPE:

cpe:2.3:a:mozilla:firefox:45.1.0:*:*:*:esr:*:*:*

firefox

Version:

45.3.0

CPE:

cpe:2.3:a:mozilla:firefox:45.3.0:*:*:*:esr:*:*:*

firefox

Version:

45.2.0

CPE:

cpe:2.3:a:mozilla:firefox:45.2.0:*:*:*:esr:*:*:*

firefox

Version:

45.1.1

CPE:

cpe:2.3:a:mozilla:firefox:45.1.1:*:*:*:esr:*:*:*

linux

Version:

5.0

CPE:

cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:*

linux

Version:

CPE:

cpe:2.3:o:oracle:linux:7:8:*:*:*:*:*:*

linux

Version:

CPE:

cpe:2.3:o:oracle:linux:6:10:*:*:*:*:*:*

This vulnerability affects 7 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-416 Top 25 #12

Use After Free

Description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations…
Exploit Likelihood: High
Typical Severity: High
Abstraction Level: Variant