What’s Vulnerable › Vulnerabilities

CVE-2016-9079: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-06-22
• EPSS: 87.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-11 · updated 2026-06-17
• Weakness: CWE-416

Description

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

Affected products

• Debian Linux: 9.0
• Mozilla Firefox: before 50.0.2; before 45.5.1 — fixed in 45.5.1, 50.0.2
• Mozilla Thunderbird: before 45.5.1 — fixed in 45.5.1
• Red Hat Enterprise Linux: 5.0, 6.0, 7.0
• RedHat Enterprise Linux Desktop: 5.0, 6.0, 7.0
• RedHat Enterprise Linux Server: 5.0, 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.3, 7.4
• RedHat Enterprise Linux Server Eus: 7.3, 7.4, 7.5
• RedHat Enterprise Linux Workstation: 5.0, 6.0, 7.0
• torproject Tor: all versions

How to fix

Upgrade to a fixed version: Mozilla Firefox 45.5.1, 50.0.2; Mozilla Thunderbird 45.5.1. Check the vendor advisory for mitigations.

References

• http://rhn.redhat.com/errata/RHSA-2016-2843.html
• http://rhn.redhat.com/errata/RHSA-2016-2850.html
• http://www.securityfocus.com/bid/94591
• http://www.securitytracker.com/id/1037370
• https://bugzilla.mozilla.org/show_bug.cgi?id=1321066
• https://security.gentoo.org/glsa/201701-15
• https://security.gentoo.org/glsa/201701-35
• https://www.debian.org/security/2016/dsa-3730
• https://www.exploit-db.com/exploits/41151/
• https://www.exploit-db.com/exploits/42327/
• https://www.mozilla.org/security/advisories/mfsa2016-92/
• http://rhn.redhat.com/errata/RHSA-2016-2843.html

Get alerted when CVE-2016-9079 or the next vulnerability affects your stack