CVE-2016-9079

EUVD-2016-9900
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
debiandebian_linux
9.0
redhatenterprise_linux
5.0
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux_desktop
5.0
redhatenterprise_linux_desktop
6.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
5.0
redhatenterprise_linux_server
6.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.3
redhatenterprise_linux_server_aus
7.4
redhatenterprise_linux_server_eus
7.3
redhatenterprise_linux_server_eus
7.4
redhatenterprise_linux_server_eus
7.5
redhatenterprise_linux_workstation
5.0
redhatenterprise_linux_workstation
6.0
redhatenterprise_linux_workstation
7.0
mozillathunderbird
𝑥
< 45.5.1
mozillafirefox
𝑥
< 50.0.2
mozillafirefox
𝑥
< 45.5.1
torprojecttor
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
firefox-esr
bookworm
115.14.0esr-1~deb12u1
fixed
bookworm (security)
128.4.0esr-1~deb12u1
fixed
bullseye
115.14.0esr-1~deb11u1
fixed
bullseye (security)
128.4.0esr-1~deb11u1
fixed
sid
128.4.0esr-1
fixed
trixie
128.3.1esr-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
precise
Fixed 50.0.2+build1-0ubuntu0.12.04.1
released
trusty
Fixed 50.0.2+build1-0ubuntu0.14.04.1
released
xenial
Fixed 50.0.2+build1-0ubuntu0.16.04.1
released
yakkety
Fixed 50.0.2+build1-0ubuntu0.16.10.1
released
thunderbird
precise
Fixed 1:45.5.1+build1-0ubuntu0.12.04.1
released
trusty
Fixed 1:45.5.1+build1-0ubuntu0.14.04.1
released
xenial
Fixed 1:45.5.1+build1-0ubuntu0.16.04.1
released
yakkety
Fixed 1:45.5.1+build1-0ubuntu0.16.10.1
released
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2016-2843.html
http://rhn.redhat.com/errata/RHSA-2016-2850.html
http://www.securityfocus.com/bid/94591
http://www.securitytracker.com/id/1037370
https://bugzilla.mozilla.org/show_bug.cgi?id=1321066
https://security.gentoo.org/glsa/201701-15
https://security.gentoo.org/glsa/201701-35
https://www.debian.org/security/2016/dsa-3730
https://www.exploit-db.com/exploits/41151/
https://www.exploit-db.com/exploits/42327/
https://www.mozilla.org/security/advisories/mfsa2016-92/
http://rhn.redhat.com/errata/RHSA-2016-2843.html
http://rhn.redhat.com/errata/RHSA-2016-2850.html
http://www.securityfocus.com/bid/94591
http://www.securitytracker.com/id/1037370
https://bugzilla.mozilla.org/show_bug.cgi?id=1321066
https://security.gentoo.org/glsa/201701-15
https://security.gentoo.org/glsa/201701-35
https://www.debian.org/security/2016/dsa-3730
https://www.exploit-db.com/exploits/41151/
https://www.exploit-db.com/exploits/42327/
https://www.mozilla.org/security/advisories/mfsa2016-92/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079