Description
Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | firefox | 40.0+build4-0ubuntu0.14.04.1 | USN-2702-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 4
- USN-2702-1 firefox vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- openSUSE-SU-2016:0894 vendor-advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-81.html
- USN-2702-3 vendor-advisory
- openSUSE-SU-2015:1389 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179484
- openSUSE-SU-2016:0876 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247 vdb-entry
- USN-2702-2 vendor-advisory
- USN-2702-1 vendor-advisory
- GLSA-201605-06 vendor-advisory
- openSUSE-SU-2015:1390 vendor-advisory