CVE-2016-9079

KEVMozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

Description

Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

PublishedJun 11, 2018

Last modifiedJun 17, 2026

Added to KEVJun 22, 2023

Remediation dueJul 13, 2023

References

rhn.redhat.com/errata/RHSA-2016-2843.htmlThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-2850.htmlThird Party Advisory
securityfocus.com/bid/94591Broken LinkThird Party Advisory
securitytracker.com/id/1037370Third Party AdvisoryVDB Entry
bugzilla.mozilla.org/show_bug.cgi?id=1321066ExploitIssue Tracking
security.gentoo.org/glsa/201701-15Third Party Advisory
security.gentoo.org/glsa/201701-35Third Party Advisory
debian.org/security/2016/dsa-3730Third Party Advisory
exploit-db.com/exploits/41151/ExploitThird Party Advisory
exploit-db.com/exploits/42327/ExploitThird Party Advisory
mozilla.org/security/advisories/mfsa2016-92/Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1202 days
CVSS: 7.5 HIGH
EPSS (30-day exploit probability): 87.4% · top 1% of all CVEs
Weakness: CWE-416
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.