KLA10906 Use-after-free vulnerability in Mozilla products

Detect date:

11/30/2016

Severity:

Critical

Description:

A use-after-free vulnerability was found in Mozilla Firefox before 50.0.2, Mozilla Firefox ESR before 45.5.1 and Mozilla Thunderbird before 45.5.1. Exploiting this vulnerability can possibly lead to a denial of service and also an execution of arbitrary code. This vulnerability can be exploited remotely via a SVG Animation.

Affected products:

Mozilla Firefox before 50.0.2
Mozilla Firefox ESR before 45.5.1
Mozilla Thunderbird before 45.5.1

Solution:

Update to the latest versions
Download Mozilla Firefox
Download Mozilla Thunderbird
Mozilla Firefox ESR

Original advisories:

Mozilla Foundation Security Advisory 2016-92

Impacts:

ACE

Related products:

Mozilla Firefox

CVE-IDS:

CVE-2016-90795.0Warning

Exploitation:

Public exploits exist for this vulnerability.