Hello, I'm not sure how to understand the rules regarding "Bonus over Base Bounty/Mozilla Bounty for code execution exploits". Are vulnerabilities affecting Firefox ESR 38.7 covered by this section? If yes, you may be interested by MFSA 2016-27 aka CVE-2016-1964: https://www.mozilla.org/en-US/security/advisories/mfsa2016-27/ Live PoC at http://nicob.net/firefox-aeshooT3/Bug-2/AtomicBaseIncDec-write_av_at_null.xml

Related CVEs

Associated Common Vulnerabilities and Exposures

CVE-2016-1964 UNKNOWN

Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Bounty

$300.00

Submitted

Weakness

Memory Corruption - Generic