Description
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | >= unspecified, < 50.0.2 |
| Mozilla | Firefox ESR | >= unspecified, < 45.5.1 |
| Mozilla | Thunderbird | >= unspecified, < 45.5.1 |
References
- http://rhn.redhat.com/errata/RHSA-2016-2843.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2850.htmlThird Party Advisory
- http://www.securityfocus.com/bid/94591Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037370Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1321066Exploit, Issue Tracking, Vendor Advisory
- https://security.gentoo.org/glsa/201701-15Third Party Advisory
- https://security.gentoo.org/glsa/201701-35Third Party Advisory
- https://www.debian.org/security/2016/dsa-3730Third Party Advisory
- https://www.exploit-db.com/exploits/41151/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/42327/Exploit, Third Party Advisory, VDB Entry
- https://www.mozilla.org/security/advisories/mfsa2016-92/Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2843.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2850.htmlThird Party Advisory
- http://www.securityfocus.com/bid/94591Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037370Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1321066Exploit, Issue Tracking, Vendor Advisory
- https://security.gentoo.org/glsa/201701-15Third Party Advisory
- https://security.gentoo.org/glsa/201701-35Third Party Advisory
- https://www.debian.org/security/2016/dsa-3730Third Party Advisory
- https://www.exploit-db.com/exploits/41151/Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/42327/Exploit, Third Party Advisory, VDB Entry
- https://www.mozilla.org/security/advisories/mfsa2016-92/Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079US Government Resource
Timeline
- Published
- Jun 11, 2018
- Last modified
- Jun 17, 2026
- Added to CISA KEV
- Jun 22, 2023
- NVD status
- Analyzed