#VU607 Arbitrary code execution in Mozilla Firefox and Oracle Linux - CVE-2016-5281
Published: September 22, 2016 / Updated: January 11, 2017
Vulnerability identifier: #VU607
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2016-5281
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Mozilla Firefox
Oracle Linux
Mozilla Firefox
Oracle Linux
Software vendor:
Mozilla
Oracle
Mozilla
Oracle
Description
The vulnerability may lead to arbitrary code execution on the target system.
The weakness exists during manipulating SVG format content through script. A use-after-free memory error in DOMSVGLength() allows attackers to execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
The weakness exists during manipulating SVG format content through script. A use-after-free memory error in DOMSVGLength() allows attackers to execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Remediation
Update to 49.0.