Vulnerability Description
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 9.0 |
| Redhat | Enterprise Linux | 5.0 |
| Redhat | Enterprise Linux Desktop | 5.0 |
| Redhat | Enterprise Linux Server | 5.0 |
| Redhat | Enterprise Linux Server Aus | 7.3 |
| Redhat | Enterprise Linux Server Eus | 7.3 |
| Redhat | Enterprise Linux Workstation | 5.0 |
| Mozilla | Thunderbird | < 45.5.1 |
| Microsoft | Windows | - |
| Mozilla | Firefox | < 50.0.2 |
| Torproject | Tor | - |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2016-2843.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2850.htmlThird Party Advisory
- http://www.securityfocus.com/bid/94591Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037370Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1321066ExploitIssue TrackingVendor Advisory
- https://security.gentoo.org/glsa/201701-15Third Party Advisory
- https://security.gentoo.org/glsa/201701-35Third Party Advisory
- https://www.debian.org/security/2016/dsa-3730Third Party Advisory
- https://www.exploit-db.com/exploits/41151/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42327/ExploitThird Party AdvisoryVDB Entry
- https://www.mozilla.org/security/advisories/mfsa2016-92/Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2843.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2850.htmlThird Party Advisory
- http://www.securityfocus.com/bid/94591Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037370Third Party AdvisoryVDB Entry
FAQ
What is CVE-2016-9079?
CVE-2016-9079 is a vulnerability with a CVSS score of 7.5 (HIGH). A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vul...
How severe is CVE-2016-9079?
CVE-2016-9079 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-9079?
Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus.