CVE-2016-5281: Use After Free
Last updated 24 July 2024
Other sources
Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.
— Launchpad
Use-after-free vulnerability when manipulating SVG format content through script
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2016-5281.
What is the severity of CVE-2016-5281?
The severity of CVE-2016-5281 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2016-5281?
Mozilla Firefox versions before 49.0, Firefox ESR versions before 45.4, and Thunderbird versions before 45.4 are affected.
How can remote attackers exploit CVE-2016-5281?
Remote attackers can exploit CVE-2016-5281 by levering improper interaction between JavaScript code and an SVG document, resulting in the execution of arbitrary code.
Are there any remedies available for CVE-2016-5281?
Yes, the remedies include updating to Mozilla Firefox version 49.0 or higher, Firefox ESR version 45.4 or higher, and Thunderbird version 45.4 or higher.