7.5
High
Exploited
CVE-2016-9079 Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-416
Description
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox 50.0 | earliest → < 50.0.2 | 50.0.2 |
| Firefox ESR 45.5 | earliest → < 45.5.1 | 45.5.1 |
| Thunderbird 45.5 | earliest → < 45.5.1 | 45.5.1 |
References
- DSA-3730 www.debian.org
- RHSA-2016:2843 rhn.redhat.com
- GLSA-201701-35 security.gentoo.org
- 1037370 www.securitytracker.com
- 42327 www.exploit-db.com
- RHSA-2016:2850 rhn.redhat.com
- www.mozilla.org www.mozilla.org
- 94591 www.securityfocus.com
- GLSA-201701-15 security.gentoo.org
- 41151 www.exploit-db.com
- bugzilla.mozilla.org bugzilla.mozilla.org
Timeline
- Published
- Added to the KEV catalogue
- Last modified