vulnwire
7.5high

CVE-2016-9079KEVin critical feed2 exploits

A use-after-free vulnerability in SVG Animation has been discovered.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.1 · CNA
CISA KEV
Yes
added 2023-06-22
EPSS
87.4%
percentile 100%
Public exploits
2
Exploit-DB

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

Known exploited (CISA KEV)

Added
3 y ago
Due date
2023-07-13 (3 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
Mozilla / Firefox, Firefox ESR, and Thunderbird
CISA name
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
partial
Assessed
20 mo ago

Exploit prediction (EPSS)

87.36% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-42327 Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution · remote · 2017-07-14
  • EDB-41151 Mozilla Firefox < 50.0.2 - 'nsSMILTimeContainer::NotifyTimeChange()' Remote Code Execution (Metasploit) · remote · 2017-01-24

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Mozilla Firefox
  • Mozilla Firefox ESR
  • Mozilla Thunderbird

Classification

Weakness

References

  • debian.org /security/2016/dsa-3730 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2843.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • security.gentoo.org /glsa/201701-35 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securitytracker.com /id/1037370 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • exploit-db.com /exploits/42327/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2850.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • mozilla.org /security/advisories/mfsa2016-92/ · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/94591 · vdb-entry, x_refsource_BID, x_transferred
  • security.gentoo.org /glsa/201701-15 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • exploit-db.com /exploits/41151/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • bugzilla.mozilla.org /show_bug.cgi?id=1321066 · x_refsource_CONFIRM, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.