high 7.5

CVE-2016-9079 kev in the critical feed json

A use-after-free vulnerability in SVG Animation has been discovered.

published 2018-06-11 8 y ago modified 2026-06-17 4 mo ago also EUVD-2016-9900

cvss: 7.5; version 3.1, CNA
cisa kev: Exploited; added 2023-06-22
epss: 87.4%; EPSS 87.4% chance of exploitation in 30 days, percentile 99.7%
public exploits: 3; Metasploit, Exploit-DB

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 3 distros 6

Mozilla Firefox 50.0.2
Mozilla Firefox ESR 45.5.1
Mozilla Thunderbird 45.5.1

debian ubuntu red hat suse opensuse arch linux

firefox-esr Debian 14, Debian 13, Debian 12 45.5.1esr-1

debian advisories DEBIAN-CVE-2016-9079

firefox Ubuntu 14.04 LTS 50.0.2+build1-0ubuntu0.14.04.1
firefox Ubuntu 16.04 LTS 50.0.2+build1-0ubuntu0.16.04.1
thunderbird Ubuntu 14.04 LTS 1:45.5.1+build1-0ubuntu0.14.04.1
thunderbird Ubuntu 16.04 LTS 1:45.5.1+build1-0ubuntu0.16.04.1

ubuntu advisories UBUNTU-CVE-2016-9079

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

thunderbird RHEL 5 PRODUCTIVITY, RHEL 5 45.5.1-1.el5_11
thunderbird RHEL 6 45.5.1-1.el6_8
thunderbird RHEL 7 45.5.1-1.el7_3
firefox RHEL 5 45.5.1-1.el5_11
firefox RHEL 6 45.5.1-1.el6_8
firefox RHEL 7 45.5.1-1.el7_3

red hat advisories RHSA-2016:2850 RHSA-2016:2843

mozilla-nss SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +6 more 3.21.3-39.1
MozillaFirefox SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +6 more 45.5.1esr-59.1
MozillaFirefox SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for SAP 12 +8 more 45.5.1esr-93.1
mozilla-nss SLES 11 SP2-LTSS 3.21.3-30.1
MozillaFirefox SLES 11 SP2-LTSS 45.5.1esr-63.1

suse advisories SUSE-SU-2016:3105-1 SUSE-SU-2016:3080-1 SUSE-SU-2016:3048-1

firefox-esr openSUSE Tumbleweed 128.5.1-1.1
MozillaFirefox openSUSE Tumbleweed 50.1.0-1.1
MozillaThunderbird openSUSE Tumbleweed 45.5.1-1.1
MozillaThunderbird Package Hub 12 45.5.1-17.1

opensuse advisories openSUSE-SU-2024:14572-1 openSUSE-SU-2024:10071-1 openSUSE-SU-2024:10230-1 openSUSE-SU-2016:3019-1

firefox Arch Linux 50.0.2-1
thunderbird Arch Linux 45.5.1-1

arch linux advisories AVG-90 AVG-91

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-9079 updated 2025-11-21 cvss 7.3

Mozilla: Firefox SVG Animation Remote Code Execution (MFSA 2016-92)

Red Hat Enterprise Linux (v. 5 server) firefox 45.5.1-1.el5_11 Red Hat Enterprise Linux Client (v. 7) firefox 45.5.1-1.el7_3, thunderbird 45.5.1-1.el7_3 Red Hat Enterprise Linux Client Optional (v. 7) firefox 45.5.1-1.el7_3 Red Hat Enterprise Linux Desktop (v. 5 client) firefox 45.5.1-1.el5_11, thunderbird 45.5.1-1.el5_11 Red Hat Enterprise Linux Desktop (v. 6) firefox 45.5.1-1.el6_8, thunderbird 45.5.1-1.el6_8 Red Hat Enterprise Linux Desktop Optional (v. 6) firefox 45.5.1-1.el6_8

+1 more productsfewer

Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox 45.5.1-1.el6_8

fixed: vendor fix RHSA-2016:2843
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird 45.5.1-1.el5_11
fixed: vendor fix RHSA-2016:2850
Red Hat Enterprise Linux Server (v. 6) firefox 45.5.1-1.el6_8 Red Hat Enterprise Linux Server (v. 7) firefox 45.5.1-1.el7_3 Red Hat Enterprise Linux Server Optional (v. 6) firefox 45.5.1-1.el6_8, thunderbird 45.5.1-1.el6_8 Red Hat Enterprise Linux Server Optional (v. 7) firefox 45.5.1-1.el7_3, thunderbird 45.5.1-1.el7_3 Red Hat Enterprise Linux Workstation (v. 6) firefox 45.5.1-1.el6_8, thunderbird 45.5.1-1.el6_8 Red Hat Enterprise Linux Workstation (v. 7) firefox 45.5.1-1.el7_3, thunderbird 45.5.1-1.el7_3

+2 more productsfewer

Red Hat Enterprise Linux Workstation Optional (v. 6) firefox 45.5.1-1.el6_8 Red Hat Enterprise Linux Workstation Optional (v. 7) firefox 45.5.1-1.el7_3

fixed: vendor fix RHSA-2016:2843

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2016-11-29 Found exploited as a 0-day (Project Zero)
2016-11-30 0-day patched (Project Zero)
2016-11-30 First public exploit (Metasploit exploit/windows/browser/firefox_smil_uaf)
2018-06-11 Published
2023-06-22 Added to CISA KEV
2023-07-13 CISA patch deadline
2025-02-07 CISA SSVC: exploitation active

Known exploited

Added: 3 y ago (2023-06-22)
Patch by: 2023-07-13 (3 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Mozilla, Firefox, Firefox ESR, and Thunderbird
CISA name: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Found: 2016-11-29
Patched: 2016-11-30
Details: project zero tracker

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: partial
Assessed: 21 mo ago (2025-02-07)

Exploit prediction

87.36% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/browser/firefox_smil_uaf Firefox nsSMILTimeContainer::NotifyTimeChange() RCE metasploit exploit, normal rank, 2016-11-30
EDB-42327 Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution remote, 2017-07-14
EDB-41151 Mozilla Firefox < 50.0.2 - 'nsSMILTimeContainer::NotifyTimeChange()' Remote Code Execution (Metasploit) remote, 2017-01-24
bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=1321066 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

Mozilla Firefox
Mozilla Firefox ESR
Mozilla Thunderbird

Classification

Weakness

CWE-416 Use After Free

References

exploit-db.com /exploits/42327/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/41151/
exploit, third-party-advisory, vdb-entry
bugzilla.mozilla.org /show_bug.cgi?id=1321066
exploit, issue-tracking, vendor-advisory
debian.org /security/2016/dsa-3730
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2016-2843.html
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/201701-35
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2016-2850.html
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/201701-15
vendor-advisory, third-party-advisory
mozilla.org /security/advisories/mfsa2016-92/
vendor-advisory
securitytracker.com /id/1037370
vdb-entry, third-party-advisory
securityfocus.com /bid/94591
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079
government-resource, us-government-resource

Sources

CVE List CVE-2016-9079
NVD CVE-2016-9079

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary