CVE-2016-9079 A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vul...
HighCVSS 7.5
EPSS 87.4%
CISA KEV
added 2023-06-22 · due 2023-07-13
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
CISA Known Exploited Vulnerability
- Date added
- 2023-06-22
- Due date (FCEB)
- 2023-07-13
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 45.5.1esr-1 | 45.5.1esr-1 |
| debian/firefox-esr(Debian:13) | < 45.5.1esr-1 | 45.5.1esr-1 |
| debian/firefox-esr(Debian:14) | < 45.5.1esr-1 | 45.5.1esr-1 |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux | = 5.0 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| mozilla Thunderbird | < 45.5.1 | 45.5.1 |
| mozilla Firefox | < 50.0.2 | 50.0.2 |
| mozilla Firefox | < 45.5.1 | 45.5.1 |
| torproject Tor | All versions | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla firefox esr | < 45.5.1 | 45.5.1 |
References
- Debian Security Tracker CVE-2016-9079 vendor-advisory
- RHSA-2016:2843 third-party-advisory vendor-advisory
- RHSA-2016:2850 third-party-advisory vendor-advisory
- 94591 broken-link third-party-advisory vdb-entry
- 1037370 third-party-advisory vdb-entry
- bugzilla.mozilla.org exploit issue-tracking vendor-advisory
- GLSA-201701-15 third-party-advisory vendor-advisory
- GLSA-201701-35 third-party-advisory vendor-advisory
- DSA-3730 third-party-advisory vendor-advisory
- 41151 exploit third-party-advisory vdb-entry
- 42327 exploit third-party-advisory vdb-entry
- www.mozilla.org vendor-advisory
- www.cisa.gov government-resource us-government-resource