CVE-2016-9899: Use After Free
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 45.6 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 50.1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 45.6 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 45.6.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-9899?
CVE-2016-9899 is classified as a high-severity vulnerability due to the potential for exploitation through use-after-free conditions.
How do I fix CVE-2016-9899?
To fix CVE-2016-9899, upgrade to Firefox version 50.1 or later, or to the appropriate Thunderbird or Firefox ESR versions listed in the advisory.
Which versions of Firefox are affected by CVE-2016-9899?
CVE-2016-9899 affects Firefox versions earlier than 50.1.
Can CVE-2016-9899 be exploited remotely?
Yes, CVE-2016-9899 can potentially be exploited remotely through crafted web content.
What types of software are impacted by CVE-2016-9899?
CVE-2016-9899 impacts Firefox, Firefox ESR, and Thunderbird running versions prior to their patched releases.