CVE-2016-9079
CVE-2016-9079
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
CVSS 7.5 · High · EPSS 87.4% · In KEV · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
firefox
- Versions
- ≥ unspecified, < 50.0.2: Affected (custom)
Update to 50.0.2
firefox esr
- Versions
- ≥ unspecified, < 45.5.1: Affected (custom)
Update to 45.5.1
thunderbird
- Versions
- ≥ unspecified, < 45.5.1: Affected (custom)
Update to 45.5.1
firefox-esr Debian:12
- Affected ranges
- ECOSYSTEM: < 45.5.1esr-1
Update to 45.5.1esr-1
firefox-esr Debian:13
- Affected ranges
- ECOSYSTEM: < 45.5.1esr-1
Update to 45.5.1esr-1
firefox-esr Debian:14
- Affected ranges
- ECOSYSTEM: < 45.5.1esr-1
Update to 45.5.1esr-1
firefox Ubuntu:14.04:LTS
- Versions
- 24.0+build1-0ubuntu1
- 25.0+build3-0ubuntu0.13.10.1
- 28.0~b2+build1-0ubuntu2
- 28.0+build1-0ubuntu1
- 28.0+build2-0ubuntu1
- 28.0+build2-0ubuntu2
- 29.0+build1-0ubuntu0.14.04.2
- 30.0+build1-0ubuntu0.14.04.3
- 31.0+build1-0ubuntu0.14.04.1
- 32.0+build1-0ubuntu0.14.04.1
- 32.0.3+build1-0ubuntu0.14.04.1
- 33.0+build2-0ubuntu0.14.04.1
- 34.0+build2-0ubuntu0.14.04.1
- 35.0+build3-0ubuntu0.14.04.2
- 35.0.1+build1-0ubuntu0.14.04.1
- 36.0+build2-0ubuntu0.14.04.4
- 36.0.1+build2-0ubuntu0.14.04.1
- 36.0.4+build1-0ubuntu0.14.04.1
- 37.0+build2-0ubuntu0.14.04.1
- 37.0.1+build1-0ubuntu0.14.04.1
- 37.0.2+build1-0ubuntu0.14.04.1
- 38.0+build3-0ubuntu0.14.04.1
- 39.0+build5-0ubuntu0.14.04.1
- 39.0.3+build2-0ubuntu0.14.04.1
- 40.0+build4-0ubuntu0.14.04.1
- 40.0+build4-0ubuntu0.14.04.4
- 40.0.3+build1-0ubuntu0.14.04.1
- 41.0+build3-0ubuntu0.14.04.1
- 41.0.1+build2-0ubuntu0.14.04.1
- 41.0.2+build2-0ubuntu0.14.04.1
- 42.0+build2-0ubuntu0.14.04.1
- 43.0+build1-0ubuntu0.14.04.1
- 43.0.4+build3-0ubuntu0.14.04.1
- 44.0+build3-0ubuntu0.14.04.1
- 44.0.1+build2-0ubuntu0.14.04.1
- 44.0.2+build1-0ubuntu0.14.04.1
- 45.0+build2-0ubuntu0.14.04.1
- 45.0.1+build1-0ubuntu0.14.04.2
- 45.0.2+build1-0ubuntu0.14.04.1
- 46.0+build5-0ubuntu0.14.04.2
- 46.0.1+build1-0ubuntu0.14.04.3
- 47.0+build3-0ubuntu0.14.04.1
- 48.0+build2-0ubuntu0.14.04.1
- 49.0+build4-0ubuntu0.14.04.1
- 49.0.2+build2-0ubuntu0.14.04.1
- 50.0+build2-0ubuntu0.14.04.2
- Affected ranges
- ECOSYSTEM: < 50.0.2+build1-0ubuntu0.14.04.1
Update to 50.0.2+build1-0ubuntu0.14.04.1
thunderbird Ubuntu:14.04:LTS
- Versions
- 1:24.0+build1-0ubuntu1
- 1:24.0+build1-0ubuntu2
- 1:24.1.1+build1-0ubuntu0.13.10.1
- 1:24.1.1+build1-0ubuntu1
- 1:24.2.0+build1-0ubuntu1
- 1:24.4.0+build1-0ubuntu1
- 1:24.5.0+build1-0ubuntu0.14.04.1
- 1:24.6.0+build1-0ubuntu0.14.04.1
- 1:31.0+build1-0ubuntu0.14.04.1
- 1:31.1.1+build1-0ubuntu0.14.04.1
- 1:31.1.2+build1-0ubuntu0.14.04.1
- 1:31.2.0+build2-0ubuntu0.14.04.1
- 1:31.3.0+build1-0ubuntu0.14.04.1
- 1:31.4.0+build1-0ubuntu0.14.04.1
- 1:31.5.0+build1-0ubuntu0.14.04.1
- 1:31.6.0+build1-0ubuntu0.14.04.1
- 1:31.7.0+build1-0ubuntu0.14.04.1
- 1:31.8.0+build1-0ubuntu0.14.04.1
- 1:38.2.0+build1-0ubuntu0.14.04.1
- 1:38.3.0+build1-0ubuntu0.14.04.1
- 1:38.4.0+build3-0ubuntu0.14.04.1
- 1:38.5.1+build2-0ubuntu0.14.04.1
- 1:38.6.0+build1-0ubuntu0.14.04.1
- 1:38.7.2+build1-0ubuntu0.14.04.1
- 1:38.8.0+build1-0ubuntu0.14.04.1
- 1:45.2.0+build1-0ubuntu0.14.04.3
- 1:45.3.0+build1-0ubuntu0.14.04.4
- 1:45.4.0+build1-0ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 1:45.5.1+build1-0ubuntu0.14.04.1
Update to 1:45.5.1+build1-0ubuntu0.14.04.1
firefox Ubuntu:16.04:LTS
- Versions
- 41.0.2+build2-0ubuntu1
- 42.0+build2-0ubuntu1
- 44.0+build3-0ubuntu2
- 44.0.1+build1-0ubuntu1
- 44.0.2+build1-0ubuntu1
- 45.0+build2-0ubuntu1
- 45.0.1+build1-0ubuntu1
- 45.0.2+build1-0ubuntu1
- 46.0+build5-0ubuntu0.16.04.2
- 46.0.1+build1-0ubuntu0.16.04.2
- 47.0+build3-0ubuntu0.16.04.1
- 48.0+build2-0ubuntu0.16.04.1
- 49.0+build4-0ubuntu0.16.04.1
- 49.0.2+build2-0ubuntu0.16.04.2
- 50.0+build2-0ubuntu0.16.04.2
- Affected ranges
- ECOSYSTEM: < 50.0.2+build1-0ubuntu0.16.04.1
Update to 50.0.2+build1-0ubuntu0.16.04.1
thunderbird Ubuntu:16.04:LTS
- Versions
- 1:38.3.0+build1-0ubuntu2
- 1:38.5.1+build2-0ubuntu1
- 1:38.6.0+build1-0ubuntu1
- 1:38.7.2+build1-0ubuntu0.16.04.1
- 1:38.8.0+build1-0ubuntu0.16.04.1
- 1:45.2.0+build1-0ubuntu0.16.04.1
- 1:45.3.0+build1-0ubuntu0.16.04.2
- 1:45.4.0+build1-0ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: < 1:45.5.1+build1-0ubuntu0.16.04.1
Update to 1:45.5.1+build1-0ubuntu0.16.04.1
Original sources
- https://www.debian.org/security/2016/dsa-3730
- http://rhn.redhat.com/errata/RHSA-2016-2843.html
- https://security.gentoo.org/glsa/201701-35
- http://www.securitytracker.com/id/1037370
- https://www.exploit-db.com/exploits/42327/
- http://rhn.redhat.com/errata/RHSA-2016-2850.html
- https://www.mozilla.org/security/advisories/mfsa2016-92/
- http://www.securityfocus.com/bid/94591
- https://security.gentoo.org/glsa/201701-15
- https://www.exploit-db.com/exploits/41151/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1321066
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079
- https://nvd.nist.gov/vuln/detail/CVE-2016-9079