# CVE-2016-9079

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

- Page: https://www.vulneraibility.com/cve/CVE-2016-9079
- CVSS: 7.5
- Known exploited: yes, in CISA KEV since 2023-06-22; CISA due date 2023-07-13
- EPSS: 87.36% (percentile 99.8)
- Public exploit code: 2 on Exploit-DB · 1 Metasploit module · 4 GitHub proofs of concept (first 2017-01-24)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2025-02-07)
- Weakness: CWE-416
- Published: 2018-06-11

## Affected versions

- Mozilla Firefox: affected < 50.0.2
- Mozilla Firefox ESR: affected < 45.5.1
- Mozilla Thunderbird: affected < 45.5.1

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://www.debian.org/security/2016/dsa-3730
- [advisory] http://rhn.redhat.com/errata/RHSA-2016-2843.html
- [advisory] https://security.gentoo.org/glsa/201701-35
- [other] http://www.securitytracker.com/id/1037370
- [exploit] https://www.exploit-db.com/exploits/42327/
- [advisory] http://rhn.redhat.com/errata/RHSA-2016-2850.html
- [other] https://www.mozilla.org/security/advisories/mfsa2016-92/
- [other] http://www.securityfocus.com/bid/94591
- [advisory] https://security.gentoo.org/glsa/201701-15
- [exploit] https://www.exploit-db.com/exploits/41151/
- [other] https://bugzilla.mozilla.org/show_bug.cgi?id=1321066
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.