Live › vulnerability › CVE-2016-9079
Go to dashboardMozilla Firefox, Firefox ESR and Thunderbird have a use-after-free bug in SVG animation code. An attacker who gets a user to load a crafted page can run code in the browser, and CISA reports it is exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Mozilla Firefox, Firefox ESR, and Thunderbird | vendor | – | – |
| debian linux | vendor | = 9.0 | – |
| redhat enterprise linux | vendor | = 5.0 | – |
| redhat enterprise linux | vendor | = 6.0 | – |
| redhat enterprise linux | vendor | = 7.0 | – |
| redhat enterprise linux desktop | vendor | = 5.0 | – |
| redhat enterprise linux desktop | vendor | = 6.0 | – |
| redhat enterprise linux desktop | vendor | = 7.0 | – |
| redhat enterprise linux server | vendor | = 5.0 | – |
| redhat enterprise linux server | vendor | = 6.0 | – |
| redhat enterprise linux server | vendor | = 7.0 | – |
| redhat enterprise linux server aus | vendor | = 7.3 | – |
| redhat enterprise linux server aus | vendor | = 7.4 | – |
| redhat enterprise linux server eus | vendor | = 7.3 | – |
| redhat enterprise linux server eus | vendor | = 7.4 | – |
| redhat enterprise linux server eus | vendor | = 7.5 | – |
| redhat enterprise linux workstation | vendor | = 5.0 | – |
| redhat enterprise linux workstation | vendor | = 6.0 | – |
| redhat enterprise linux workstation | vendor | = 7.0 | – |
| mozilla thunderbird | vendor | < 45.5.1 | 45.5.1 |
| mozilla firefox | vendor | < 50.0.2 | 50.0.2 |
| mozilla firefox | vendor | < 45.5.1 | 45.5.1 |
| torproject tor | vendor | – | – |
Check the installed Firefox, Firefox ESR or Thunderbird version under Help > About; unknown for a command-line check.
Update Firefox, Firefox ESR and Thunderbird to a release from Mozilla that fixes CVE-2016-9079, per vendor instructions; the fixed version is unknown from these sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
This page as .md · .json · in your agent: get_signal("CVE-2016-9079")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.