CVE-2016-9079

Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free

7.5 HIGHActively exploited (CISA KEV)Public exploitEPSS 87.4%

Published11 Jun 2018
Added to CISA KEV22 Jun 2023
Remediation due13 Jul 2023

Description

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Mozilla Firefox< 50.0.2 · < 45.5.1

Mozilla Thunderbird< 45.5.1

Torproject Torall versions

Debian Linux9.0

Redhat Enterprise Linux5.0 · 6.0 · 7.0

Redhat Enterprise Linux Desktop5.0 · 6.0 · 7.0

Redhat Enterprise Linux Server5.0 · 6.0 · 7.0

Redhat Enterprise Linux Server Aus7.3 · 7.4

Redhat Enterprise Linux Server Eus7.3 · 7.4 · 7.5

Redhat Enterprise Linux Workstation5.0 · 6.0 · 7.0

Remediation

Fixed in

Mozilla Firefox≥ 50.0.2

Mozilla Thunderbird≥ 45.5.1

Patch & vendor advisories

References

http://rhn.redhat.com/errata/RHSA-2016-2843.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2850.htmlThird Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1321066ExploitIssue TrackingVendor Advisory
https://security.gentoo.org/glsa/201701-15Third Party Advisory
https://security.gentoo.org/glsa/201701-35Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079US Government Resource
https://www.debian.org/security/2016/dsa-3730Third Party Advisory
https://www.exploit-db.com/exploits/41151/ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/42327/ExploitThird Party AdvisoryVDB Entry
https://www.mozilla.org/security/advisories/mfsa2016-92/Vendor Advisory

and 2 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2016-9079 being actively exploited?

Yes. CVE-2016-9079 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 22 Jun 2023.

How severe is CVE-2016-9079?

CVE-2016-9079 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 87.4% probability of exploitation.

Which products are affected by CVE-2016-9079?

Affected products include Mozilla Firefox, Mozilla Thunderbird, Torproject Tor, Debian Linux, Redhat Enterprise Linux, and 5 more.

How do I fix CVE-2016-9079?

Upgrade affected software to a fixed version, for example Mozilla Firefox 50.0.2, Mozilla Thunderbird 45.5.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2016-9079 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.