{"id":"CVE-2016-9079","state":"PUBLISHED","title":"A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users ","description":"A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.","publishedAt":"2018-06-11T21:00:00.000Z","updatedAt":"2025-10-21T23:45:50.578Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"mozilla","products":["Mozilla Firefox","Mozilla Firefox ESR","Mozilla Thunderbird"],"affected":[{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","status":"affected","lessThan":"50.0.2","versionType":"custom"}]},{"vendor":"Mozilla","product":"Firefox ESR","versions":[{"version":"unspecified","status":"affected","lessThan":"45.5.1","versionType":"custom"}]},{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"unspecified","status":"affected","lessThan":"45.5.1","versionType":"custom"}]}],"references":["https://www.debian.org/security/2016/dsa-3730","http://rhn.redhat.com/errata/RHSA-2016-2843.html","https://security.gentoo.org/glsa/201701-35","http://www.securitytracker.com/id/1037370","https://www.exploit-db.com/exploits/42327/","http://rhn.redhat.com/errata/RHSA-2016-2850.html","https://www.mozilla.org/security/advisories/mfsa2016-92/","http://www.securityfocus.com/bid/94591","https://security.gentoo.org/glsa/201701-15","https://www.exploit-db.com/exploits/41151/","https://bugzilla.mozilla.org/show_bug.cgi?id=1321066","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T19:42:58.401Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2016/9xxx/CVE-2016-9079.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2016-9079","state":"PUBLISHED","datePublished":"2018-06-11T21:00:00.000Z","dateUpdated":"2025-10-21T23:45:50.578Z","assignerShortName":"mozilla","assignerOrgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateReserved":"2016-10-27T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1."}],"affected":[{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","status":"affected","lessThan":"50.0.2","versionType":"custom"}]},{"vendor":"Mozilla","product":"Firefox ESR","versions":[{"version":"unspecified","status":"affected","lessThan":"45.5.1","versionType":"custom"}]},{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"unspecified","status":"affected","lessThan":"45.5.1","versionType":"custom"}]}],"references":[{"url":"https://www.debian.org/security/2016/dsa-3730","name":"DSA-3730","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2843.html","name":"RHSA-2016:2843","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://security.gentoo.org/glsa/201701-35","name":"GLSA-201701-35","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://www.securitytracker.com/id/1037370","name":"1037370","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.exploit-db.com/exploits/42327/","name":"42327","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2850.html","name":"RHSA-2016:2850","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2016-92/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/94591","name":"94591","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://security.gentoo.org/glsa/201701-15","name":"GLSA-201701-15","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://www.exploit-db.com/exploits/41151/","name":"41151","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1321066","tags":["x_refsource_CONFIRM"]}],"problemTypes":[{"descriptions":[{"description":"Use-after-free in SVG Animation","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"mozilla","dateUpdated":"2018-06-12T09:57:01.000Z","orgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe"},"datePublic":"2016-11-30T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@mozilla.org","ID":"CVE-2016-9079","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Firefox","version":{"version_data":[{"version_affected":"<","version_value":"50.0.2"}]}},{"product_name":"Firefox ESR","version":{"version_data":[{"version_affected":"<","version_value":"45.5.1"}]}},{"product_name":"Thunderbird","version":{"version_data":[{"version_affected":"<","version_value":"45.5.1"}]}}]},"vendor_name":"Mozilla"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Use-after-free in SVG Animation"}]}]},"references":{"reference_data":[{"name":"DSA-3730","refsource":"DEBIAN","url":"https://www.debian.org/security/2016/dsa-3730"},{"name":"RHSA-2016:2843","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2016-2843.html"},{"name":"GLSA-201701-35","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201701-35"},{"name":"1037370","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1037370"},{"name":"42327","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/42327/"},{"name":"RHSA-2016:2850","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2016-2850.html"},{"name":"https://www.mozilla.org/security/advisories/mfsa2016-92/","refsource":"CONFIRM","url":"https://www.mozilla.org/security/advisories/mfsa2016-92/"},{"name":"94591","refsource":"BID","url":"http://www.securityfocus.com/bid/94591"},{"name":"GLSA-201701-15","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201701-15"},{"name":"41151","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/41151/"},{"name":"https://bugzilla.mozilla.org/show_bug.cgi?id=1321066","refsource":"CONFIRM","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1321066"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.debian.org/security/2016/dsa-3730","name":"DSA-3730","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2843.html","name":"RHSA-2016:2843","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201701-35","name":"GLSA-201701-35","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://www.securitytracker.com/id/1037370","name":"1037370","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/42327/","name":"42327","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2850.html","name":"RHSA-2016:2850","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2016-92/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/94591","name":"94591","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201701-15","name":"GLSA-201701-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/41151/","name":"41151","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1321066","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-06T02:42:10.169Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2016-9079","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-02-07T12:50:20.570667Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2023-06-22","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T23:45:50.578Z"},"timeline":[{"time":"2023-06-22T00:00:00.000Z","lang":"en","value":"CVE-2016-9079 added to CISA KEV"}]}]}}}