cbcvebase.
CVE-2016-9899
published 2018-06-11

CVE-2016-9899: Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox <…

PriorityP264critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
21.40%
97.3th percentile
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Affected

31 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianfirefox< firefox 50.1.0-1 (sid)firefox 50.1.0-1 (sid)
debianfirefox-esr< firefox 50.1.0-1 (sid)firefox 50.1.0-1 (sid)
mozillafirefox< 53.053.0
mozillafirefox< 45.9.045.9.0
mozillafirefox>= 0 < 50.1.0+build2-0ubuntu0.14.04.150.1.0+build2-0ubuntu0.14.04.1
mozillafirefox>= 0 < 50.1.0+build2-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.1
mozillafirefox>= 52.0 < 52.1.052.1.0
mozillafirefox>= unspecified < 50.150.1
mozillafirefox_esr>= unspecified < 45.645.6
mozillathunderbird< 52.1.052.1.0
mozillathunderbird>= 0 < 1:45.7.0+build1-0ubuntu0.14.04.11:45.7.0+build1-0ubuntu0.14.04.1
mozillathunderbird>= 0 < 1:45.7.0+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.1
mozillathunderbird>= unspecified < 45.645.6
redhatenterprise_linux
redhatenterprise_linux
redhatenterprise_linux
redhatenterprise_linux_desktop
redhatenterprise_linux_desktop
redhatenterprise_linux_desktop
redhatenterprise_linux_server
redhatenterprise_linux_server
redhatenterprise_linux_server
redhatenterprise_linux_server_aus
redhatenterprise_linux_server_aus

Detection & IOCsextracted from sources · hover to see the quote

commanddoc.body.appendChild(document.createElement("audio")).remove();
commanddoc.getElementsByTagName("*")[0].removeEventListener("DOMSubtreeModified",handler,false);
  • Exploit triggers use-after-free by appending and immediately removing an <audio> element inside a DOMSubtreeModified event handler, cycling 1024 blocks of 1024 bytes to groom the heap.
  • The exploit registers a DOMSubtreeModified event listener on all elements ('*') to trigger the vulnerable code path during DOM node adoption.
  • Affected versions: Firefox < 50.1, Firefox ESR < 45.6, Thunderbird < 45.6 — presence of these versions in the environment indicates exposure.

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.