CVE-2016-1962: Use After Free
Published Mar 13, 2016
·Updated
Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.
Affected Software
31 affected components
Mozilla Firefox<=44.0.2
Mozilla Firefox=38.0
Mozilla Firefox=38.0.1
Mozilla Firefox=38.0.5
Mozilla Firefox=38.1.0
Mozilla Firefox=38.1.1
Mozilla Firefox=38.2.0
Mozilla Firefox=38.2.1
Mozilla Firefox=38.3.0
Mozilla Firefox=38.4.0
Mozilla Firefox=38.5.0
Mozilla Firefox=38.5.1
Mozilla Firefox=38.6.0
Mozilla Firefox=38.6.1
openSUSE openSUSE=13.1
Oracle Linux=5.0
Oracle Linux=6
Oracle Linux=7
Mozilla Firefox ESR=38.0
Mozilla Firefox ESR=38.0.1
Mozilla Firefox ESR=38.0.5
Mozilla Firefox ESR=38.1.0
Mozilla Firefox ESR=38.1.1
Mozilla Firefox ESR=38.2.0
Mozilla Firefox ESR=38.2.1
Mozilla Firefox ESR=38.3.0
Mozilla Firefox ESR=38.4.0
Mozilla Firefox ESR=38.5.0
Mozilla Firefox ESR=38.5.1
Mozilla Firefox ESR=38.6.0
Mozilla Firefox ESR=38.6.1
Event History
Mar 13, 2016
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1962?
The severity of CVE-2016-1962 is critical due to the potential for remote code execution.
2
How do I fix CVE-2016-1962?
To fix CVE-2016-1962, update Mozilla Firefox to version 45.0 or later, or Firefox ESR to version 38.7 or later.
3
What software is affected by CVE-2016-1962?
CVE-2016-1962 affects Mozilla Firefox versions before 45.0 and Firefox ESR versions before 38.7.
4
What type of vulnerability is CVE-2016-1962?
CVE-2016-1962 is a use-after-free vulnerability related to WebRTC data-channel connections.
5
Can CVE-2016-1962 be exploited remotely?
Yes, CVE-2016-1962 can be exploited remotely, allowing attackers to execute arbitrary code.