CVE-2016-5256

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.mozilla.org/security/announce/2016/mfsa2016-85.htmlVendor Advisory
http://www.securityfocus.com/bid/93052
http://www.securitytracker.com/id/1036852
https://bugzilla.mozilla.org/show_bug.cgi?id=1268034Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1276413Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1282746Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1290244Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1296078Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1296087Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1297099Issue Tracking
https://security.gentoo.org/glsa/201701-15
http://www.mozilla.org/security/announce/2016/mfsa2016-85.htmlVendor Advisory
http://www.securityfocus.com/bid/93052
http://www.securitytracker.com/id/1036852
https://bugzilla.mozilla.org/show_bug.cgi?id=1268034Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1276413Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1282746Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1290244Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1296078Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1296087Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1297099Issue Tracking
https://security.gentoo.org/glsa/201701-15

Timeline

Published: Sep 22, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-52579.8Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird < 45 CVE-2016-52588.8Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attac CVE-2016-52598.8Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 al CVE-2016-52606.5Mozilla Firefox before 48.0 mishandles changes from 'INPUT type="password"' to 'INPUT type="text"' within a single Session Manager session, CVE-2016-52618.8Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remo CVE-2016-52626.1Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandb CVE-2016-52638.8The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformat CVE-2016-52648.8Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x CVE-2016-52655.5Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and cond CVE-2016-52668.1Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (aka dataTransfer) actions for file: URIs, which allows user-assisted r CVE-2016-52675.3Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a r CVE-2016-52684.3Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for err