CVE-2016-5277
CriticalSummary
Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.
Risk Assessment
Organizations may be exposed to remote attacks that could lead to unauthorized code execution or disruption of services due to memory corruption.
Recommendation
It is recommended to update Mozilla Firefox and Thunderbird to the latest versions to mitigate this vulnerability.
Original NVD description (English source)
Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.