Mozilla · Firefox, Firefox ESR, and Thunderbird
CVE-2016-9079
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
What it is
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
CISA: Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: July 13, 2023
- Added to the CISA list
- June 22, 2023
- Published
- June 11, 2018
- Severity
- High 7.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 87% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-416
- More details
- NVD · CVE.org · CISA
All references (11)
- https://www.debian.org/security/2016/dsa-3730
- http://rhn.redhat.com/errata/RHSA-2016-2843.html
- https://security.gentoo.org/glsa/201701-35
- http://rhn.redhat.com/errata/RHSA-2016-2850.html
- https://security.gentoo.org/glsa/201701-15
- http://www.securitytracker.com/id/1037370
- https://www.exploit-db.com/exploits/42327/
- https://www.mozilla.org/security/advisories/mfsa2016-92/
- http://www.securityfocus.com/bid/94591
- https://www.exploit-db.com/exploits/41151/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1321066
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 6, 2025 | Remote Code Execution | Multiple Products | Critical 9.8 | 83% |
| Oct 15, 2024 | Use-After-Free | Firefox | Critical 9.8 | 23% |
| May 25, 2022 | Security Feature Bypass | Firefox | High 8.8 | 69% |
| May 23, 2022 | Type Confusion | Firefox and Thunderbird | High 8.8 | 38% |
| May 23, 2022 | Sandbox Escape | Firefox and Thunderbird | Critical 10.0 | 56% |
| Mar 28, 2022 | Denial-of-Service | Firefox and Thunderbird | High 8.8 | 69% |
| Mar 7, 2022 | Use-After-Free | Firefox | High 8.8 | 14% |
| Mar 7, 2022 | Use-After-Free | Firefox | Critical 9.6 | 2.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.