{"id":"CVE-2016-9079","kind":"vulnerability","aliases":["CVE-2016-9079"],"related":[],"title":"A use-after-free vulnerability in SVG Animation has been discovered","description":"A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.","summary":"Mozilla Firefox, Firefox ESR and Thunderbird have a use-after-free bug in SVG animation code. An attacker who gets a user to load a crafted page can run code in the browser, and CISA reports it is exploited in the wild.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2023-06-22T00:00:00+00:00","products":[{"name":"Mozilla Firefox, Firefox ESR, and Thunderbird","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 7.3","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 7.4","ecosystem":"vendor"},{"name":"redhat enterprise linux server eus","fixed":[],"affected":"= 7.3","ecosystem":"vendor"},{"name":"redhat enterprise linux server eus","fixed":[],"affected":"= 7.4","ecosystem":"vendor"},{"name":"redhat enterprise linux server eus","fixed":[],"affected":"= 7.5","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 5.0","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"mozilla thunderbird","fixed":["45.5.1"],"affected":"< 45.5.1","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["50.0.2"],"affected":"< 50.0.2","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["45.5.1"],"affected":"< 45.5.1","ecosystem":"vendor"},{"name":"torproject tor","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firefox","firefox-esr","package","thunderbird","tor-browser","windows"],"not_affected_if":["unpatched-builds-not-in-use"],"how_to_check":"Check the installed Firefox, Firefox ESR or Thunderbird version under Help > About; unknown for a command-line check.","fix":"Update Firefox, Firefox ESR and Thunderbird to a release from Mozilla that fixes CVE-2016-9079, per vendor instructions; the fixed version is unknown from these sources.","status":"open","published_at":"2018-06-11T21:29:01+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:33+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:06:33Z","model":"claude-haiku-5-5","output":{"fix":"Update Firefox, Firefox ESR and Thunderbird to a release from Mozilla that fixes CVE-2016-9079, per vendor instructions; the fixed version is unknown from these sources.","reach":"internet","impact":"high","summary":"Mozilla Firefox, Firefox ESR and Thunderbird have a use-after-free bug in SVG animation code. An attacker who gets a user to load a crafted page can run code in the browser, and CISA reports it is exploited in the wild.","category":"package","who_cares":["firefox","firefox-esr","thunderbird","windows","tor-browser"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code in the browser when a user visits a malicious page","analyst_note":"Find the fixed Firefox, ESR and Thunderbird versions in Mozilla's advisory for CVE-2016-9079 (mozilla.org/security/advisories) and confirm the Windows and Tor browser scope.","how_to_check":"Check the installed Firefox, Firefox ESR or Thunderbird version under Help > About; unknown for a command-line check.","needs_analyst":true,"not_affected_if":["unpatched-builds-not-in-use"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000514,"input_tokens":2853,"output_tokens":458,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':14A,17A '-9079':15A,18A '45.5.1':198C,201C '50.0.2':195C 'affect':193C 'and':23A 'anim':9A,131B,167C 'attack':134B 'aus':64A,69A 'browser':114B,149B,187C 'bug':128B 'built':173C 'cisa':151B 'code':132B,146B 'craft':142B 'cve':13A,16A 'debian':25A 'desktop':39A,43A,47A 'discov':12A,170C,179C 'enterprise':28A,31A,34A,37A,41A,45A,49A,53A,57A,61A,66A,71A,76A,81A,86A,90A,94A 'esr':22A,109B,119B,197C 'eus':74A,79A,84A 'exploit':105B,155B,172C 'firefox':20A,21A,100A,102A,106B,108B,117B,118B,184C,194C,196C 'firefox-esr':107B 'free':5A,127B,163C 'get':136B 'linux':26A,29A,32A,35A,38A,42A,46A,50A,54A,58A,62A,67A,72A,77A,82A,87A,91A,95A 'load':140B 'mozilla':19A,97A,99A,101A,116B 'packag':110B 'page':143B 'redhat':27A,30A,33A,36A,40A,44A,48A,52A,56A,60A,65A,70A,75A,80A,85A,89A,93A 'report':152B 'run':145B 'server':51A,55A,59A,63A,68A,73A,78A,83A 'svg':8A,130B,166C 'target':183C 'thunderbird':24A,98A,111B,121B,200C 'tor':104A,113B,186C 'tor-brows':112B 'torproject':103A 'use':3A,125B,161C 'use-after-fre':2A,124B,160C 'user':138B,188C 'vulner':6A,164C,176C,192C 'wild':158B,182C 'window':115B,190C 'workstation':88A,92A,96A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-06-11T21:29:01+00:00","kev":{"dateAdded":"2023-06-22","dueDate":"2023-07-13","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-9079","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9079","severity":null,"published_at":"2023-06-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-9079","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9079","severity":null,"published_at":"2018-06-11T21:29:01+00:00","modified_at":"2026-06-17T00:55:29+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}