CVE-2016-5258 Use after free in n/a

High 8.8 Published 5 Aug 2016 Updated 6 Aug 2024

Remote attackers can execute arbitrary code via a use-after-free flaw in Firefox's WebRTC socket thread during session shutdown.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2016-5258?

CVE-2016-5258 is a high-severity use after free vulnerability in Mozilla Firefox, published on 5 Aug 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.

Weakness: CWE-416

Which versions are affected by CVE-2016-5258?

It affects 2 products.

Products include Mozilla Firefox, Oracle Linux.

How do I fix CVE-2016-5258?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2016-5258 being exploited?

There is no known exploitation of CVE-2016-5258 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-5258, GHSA-5v6h-wvqr-3crq, UBUNTU-CVE-2016-5258.