CVE-2016-9079
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
Published Jun 11, 2018 · updated Jun 16, 2026 · debian debian linux
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
Timeline
Detection, updates, and resolution for this record.
Jun 11, 2018 · Catalog
Detected
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
Jun 22, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jul 13, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
Required action
Apply updates per vendor instructions.
CISA due date Jul 13, 2023
Affected
- cpe debian/debian linux9.0
- cpe mozilla/firefoxversion unspecified
- cpe mozilla/thunderbirdversion unspecified
- cpe redhat/enterprise linux5.0
- cpe redhat/enterprise linux6.0
- cpe redhat/enterprise linux7.0
- cpe redhat/enterprise linux desktop5.0
- cpe redhat/enterprise linux desktop6.0
- cpe redhat/enterprise linux desktop7.0
- cpe redhat/enterprise linux server5.0
- cpe torproject/torversion unspecified
- vendor Mozilla Firefox, Firefox ESR, and Thunderbirdversion unspecified
Sources
- CISA KEVCVE-2016-9079
Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.
cisa.gov - CVE.orgCVE-2016-9079
Official CVE identifier
cve.org - FIRST EPSSCVE-2016-9079
30-day exploitation probability 87.5%
first.org - Exploit Database41151
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database42327
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_windows/browser/firefox_smil_uaf
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2016-9079
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.
nvd.nist.gov