Arbitrary code execution in Mozilla Firefox and Oracle Linux - CVE-2016-5281

Vulnerability identifier: #VU607

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-5281

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability may lead to arbitrary code execution on the target system.
The weakness exists during manipulating SVG format content through script. A use-after-free memory error in DOMSVGLength() allows attackers to execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Mozilla Firefox
Oracle Linux

Update to 49.0.

• https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/
• http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

• Arbitrary code execution in Mozilla Firefox