CVE-2016-5258

Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.

• CWE-416

• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html
• http://rhn.redhat.com/errata/RHSA-2016-1551.html
• http://www.debian.org/security/2016/dsa-3640
• http://www.mozilla.org/security/announce/2016/mfsa2016-72.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlThird Party Advisory
• http://www.securityfocus.com/bid/92258
• http://www.securitytracker.com/id/1036508
• http://www.ubuntu.com/usn/USN-3044-1
• https://bugzilla.mozilla.org/show_bug.cgi?id=1279146Exploit, Issue Tracking
• https://security.gentoo.org/glsa/201701-15
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html
• http://rhn.redhat.com/errata/RHSA-2016-1551.html
• http://www.debian.org/security/2016/dsa-3640
• http://www.mozilla.org/security/announce/2016/mfsa2016-72.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlThird Party Advisory
• http://www.securityfocus.com/bid/92258
• http://www.securitytracker.com/id/1036508
• http://www.ubuntu.com/usn/USN-3044-1
• https://bugzilla.mozilla.org/show_bug.cgi?id=1279146Exploit, Issue Tracking
• https://security.gentoo.org/glsa/201701-15

Published

Aug 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5252Stack-based buffer underflow in the mozilla::gfx::BasePoint4…
• CVE-2016-5253The Updater in Mozilla Firefox before 48.0 on Windows allows…
• CVE-2016-5254Use-after-free vulnerability in the nsXULPopupManager::KeyDo…
• CVE-2016-5255Use-after-free vulnerability in the js::PreliminaryObjectArr…
• CVE-2016-5256Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2016-5257Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2016-5259Use-after-free vulnerability in the CanonicalizeXPCOMPartici…
• CVE-2016-5260Mozilla Firefox before 48.0 mishandles changes from 'INPUT t…
• CVE-2016-5261Integer overflow in the WebSocketChannel class in the WebSoc…
• CVE-2016-5262Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3…
• CVE-2016-5263The nsDisplayList::HitTest function in Mozilla Firefox befor…
• CVE-2016-5264Use-after-free vulnerability in the nsNodeUtils::NativeAnony…