CVE-2016-5281

Critical

Published: 22/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before version 49.0, Firefox ESR 45.x before 45.4, and Thunderbird before 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data theft.

Recommendation

It is recommended to update Mozilla Firefox and Thunderbird to the latest versions to mitigate this vulnerability.

Original NVD description (English source)

Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.