Log in Start free

Actively exploited · Published Jun 11, 2018 · Assigned by mozilla

CVE-2016-9079

High 7.5 Exploited

In plain English

A high-severity use-after-free in Firefox from Mozilla. Attackers are actively exploiting it in the wild (listed by CISA on June 22, 2023). The chance it is exploited in the next 30 days is estimated at 87.4% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)87.4%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Jun 22, 2023
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jul 13, 2023.

Official description

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12firefox-esr45.5.1esr-1DEBIAN-CVE-2016-9079
Debian:13firefox-esr45.5.1esr-1DEBIAN-CVE-2016-9079
Debian:14firefox-esr45.5.1esr-1DEBIAN-CVE-2016-9079

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 50.0.2
Mozilla Firefox ESR unspecified – before 45.5.1
Mozilla Thunderbird unspecified – before 45.5.1

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References