CVE-2016-9079: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

CVSS: 7.5v3.1HighKEVAnalyzed

AliasesMGASA-2016-0410SUSE-SU-2016:3048-1RHSA-2016:2843+4 more

Published 11-06-2018Last modified 21-10-2025

Vulnerability summary

CVE-2016-9079 is a high (CVSS 7.5) Use After Free vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird. It is known to be exploited: CISA lists it, first on 22-06-2023. EPSS estimates a 87.36% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

87.36%

0%100%

Critical · -0.07 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 12 · Related 8

DLA-730-1 DLA-752-1 DSA-3730-1 MGASA-2016-0409 OPENSUSE-SU-2016:3019-1 OPENSUSE-SU-2024:10071-1+6 more

Timeline

11-06-2018
PublishedVulnerability first disclosed.
22-06-2023
Added to CISA KEVMozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
13-07-2023
CISA remediation dueApply updates per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

CVSS metrics

6 scores · 5 sources · 3 versions

v3.17.5v3.07.3v2.05.0

EPSS trend

Probability

87.36%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.07 pp

From 87.42% on 18-09-2026

18-09-202618-10-2026

EPSS score

87.36%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 22-06-2023
Federal due date: 13-07-2023

CISA required action

Apply updates per vendor instructions. www.mozilla.org/en-US/security/advisories/mfsa2016-92/ nvd.nist.gov/vuln/detail/CVE-2016-9079

Public exploits

4 found

referenceUnverified
Exploit Reference (bugzilla.mozilla.org)
Maturity: unknown
exploit-databaseremotewindowsUnverified
Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution
Maturity: poc
exploit-databaseremotewindowsVerified
Mozilla Firefox < 50.0.2 - 'nsSMILTimeContainer::NotifyTimeChange()' Remote Code Execution (Metasploit)
Maturity: weaponized

Show all 4 exploits

MetasploitremoteUnverified
Firefox nsSMILTimeContainer::NotifyTimeChange() RCE
exploit/windows/browser/firefox_smil_uaf
Maturity: poc

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Suse11 products

MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP1< 45.5.1esr-93.1
MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP2< 45.5.1esr-93.1
MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP1< 45.5.1esr-93.1
MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP2< 45.5.1esr-93.1
MozillaFirefox&distro=SUSE Linux Enterprise Server 12-LTSS< 45.5.1esr-93.1

Show all 11

Redhat10 products

enterprise_linuxEOL5.0 | 6.0 | 7.0
enterprise_linux_desktop5.0 | 6.0 | 7.0
enterprise_linux_server5.0 | 6.0 | 7.0
enterprise_linux_server_aus7.3 | 7.4
enterprise_linux_server_eus7.3 | 7.4 | 7.5

Show all 10

Mageia3 products

firefox< 45.5.1-1.mga5
firefox-l10n< 45.5.1-1.mga5
nss< 3.27.2-1.mga5

Mozilla3 products

firefox≥ unspecified, < 50.0.2 | < 50.0.2 | < 45.5.1
firefox_esr≥ unspecified, < 45.5.1
thunderbird≥ unspecified, < 45.5.1 | < 45.5.1

Debian2 products

firefox-esr< 45.5.1esr-1 | < 45.5.1esr-1~deb8u1
debian_linuxEOL9.0

Ubuntu2 products

firefox< 50.0.2+build1-0ubuntu0.14.04.1 | < 50.0.2+build1-0ubuntu0.16.04.1
thunderbird< 1:45.5.1+build1-0ubuntu0.14.04.1 | < 1:45.5.1+build1-0ubuntu0.16.04.1

Torproject1 product

torna

7 vendors · 32 products

References

36 links

www.debian.org/security/2016/dsa-3730Vendor AdvisoryX Refsource DEBIANThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-2843.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
security.gentoo.org/glsa/201701-35Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www.securitytracker.com/id/1037370VDB EntryX Refsource SECTRACKThird Party Advisory
www.exploit-db.com/exploits/42327/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
rhn.redhat.com/errata/RHSA-2016-2850.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.mozilla.org/security/advisories/mfsa2016-92/X Refsource CONFIRMVendor Advisory
www.securityfocus.com/bid/94591VDB EntryX Refsource BIDBroken LinkThird Party Advisory
security.gentoo.org/glsa/201701-15Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www.exploit-db.com/exploits/41151/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry

Show all 36 references

bugzilla.mozilla.org/show_bug.cgi?id=1321066X Refsource CONFIRMExploitIssue TrackingVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079Government ResourceUS Government Resource
advisories.mageia.org/MGASA-2016-0410.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=19878REPORT
www.mozilla.org/en-US/security/advisories/mfsa2016-92/AdvisoryREPORT
www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/WEB
rhn.redhat.com/errata/RHSA-2016-2843.htmlWEB
www.suse.com/support/update/announcement/2016/suse-su-20163048-1/Advisory
bugzilla.suse.com/1012964REPORT
www.suse.com/security/cve/CVE-2016-9079WEB
access.redhat.com/errata/RHSA-2016:2843Advisory
access.redhat.com/security/updates/classification/ARTICLE
www.mozilla.org/en-US/security/advisories/mfsa2016-92/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1400376REPORT
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2843.jsonAdvisory
access.redhat.com/security/cve/CVE-2016-9079REPORT
www.cve.org/CVERecord?id=CVE-2016-9079AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2016-9079Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogARTICLEREPORT
access.redhat.com/errata/RHSA-2016:2850Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2850.jsonAdvisory
ubuntu.com/security/CVE-2016-9079REPORT
ubuntu.com/security/notices/USN-3140-1Advisory
ubuntu.com/security/notices/USN-3141-1Advisory
security-tracker.debian.org/tracker/CVE-2016-9079Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities