CVE-2016-9079
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
Description
CVE-2016-9079 is a use-after-free vulnerability in SVG Animation processing within Mozilla Firefox, Firefox ESR, and Thunderbird. The flaw was discovered being actively exploited in the wild, specifically targeting Firefox and Tor Browser users on Windows. Affecting Firefox versions before 50.0.2, Firefox ESR before 45.5.1, and Thunderbird before 45.5.1, this vulnerability allows a remote attacker to access sensitive information from the victim's system without any user interaction. CISA has included CVE-2016-9079 in its Known Exploited Vulnerabilities catalog, and with an EPSS score of 84.8% (99th percentile), exploitation activity remains highly probable.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| debian | debian linux | 9.0 |
| redhat | enterprise linux | 5.0; 6.0; 7.0 |
| redhat | enterprise linux desktop | 5.0; 6.0; 7.0 |
| redhat | enterprise linux server | 5.0; 6.0; 7.0 |
| redhat | enterprise linux server aus | 7.3; 7.4 |
| redhat | enterprise linux server eus | 7.3; 7.4; 7.5 |
| redhat | enterprise linux workstation | 5.0; 6.0; 7.0 |
| mozilla | thunderbird | < 45.5.1 |
| mozilla | firefox | < 50.0.2; < 45.5.1 |
| torproject | tor | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://rhn.redhat.com/errata/RHSA-2016-2843.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2016-2850.html(Third Party Advisory)
- http://www.securityfocus.com/bid/94591(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037370(Third Party Advisory, VDB Entry)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1321066(Exploit, Issue Tracking, Vendor Advisory)
- https://security.gentoo.org/glsa/201701-15(Third Party Advisory)
- https://security.gentoo.org/glsa/201701-35(Third Party Advisory)
- https://www.debian.org/security/2016/dsa-3730(Third Party Advisory)
- https://www.exploit-db.com/exploits/41151/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42327/(Exploit, Third Party Advisory, VDB Entry)
- https://www.mozilla.org/security/advisories/mfsa2016-92/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079(US Government Resource)
Weakness Type
CWE-416: Use After Free
In Mozilla Firefox, Firefox ESR, and Thunderbird, a use-after-free condition occurs during the processing of SVG Animation elements. The application references memory after it has been freed, which can lead to arbitrary memory access. In the context of CVE-2016-9079, this flaw was weaponized to extract sensitive information from targeted users, particularly those using Firefox and Tor Browser on Windows.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2016-9079 is a remotely exploitable use-after-free vulnerability that requires no authentication and no user interaction to trigger, as it can be exploited simply by visiting a malicious web page or rendering crafted SVG content. With a CVSS score of 7.5 (High), the primary impact is on confidentiality. Confidentiality (High): Successful exploitation allows the attacker to read sensitive information from the victim's system memory, which was demonstrated in the wild through attacks targeting Firefox and Tor Browser users on Windows to de-anonymize users and extract system data. Integrity (None): The vulnerability does not directly allow modification of data or system files. Availability (None): The flaw does not cause denial of service. The EPSS score of 84.8% (99th percentile) places this vulnerability among the most likely to be exploited, and its confirmed use in targeted attacks against Tor Browser users underscores its severity in practice despite the Medium-range CVSS score.
Exploit Maturity
Public exploit code is available for CVE-2016-9079 through multiple sources, including Exploit-DB entry 41151 and Exploit-DB entry 42327, as well as the Mozilla Bugzilla report which documents the original exploit discovered in the wild. CISA has confirmed active exploitation by including this vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of July 13, 2023. The exploit was originally discovered targeting Firefox and Tor Browser users on Windows, indicating nation-state or advanced threat actor involvement in its development. The EPSS score of 84.8% (99th percentile) indicates near-certain exploitation activity, reflecting the availability of multiple working exploits and the broad attack surface across Firefox, Firefox ESR, and Thunderbird.
Remediation
- Upgrade Mozilla products immediately: update Firefox to version 50.0.2 or later, Firefox ESR to version 45.5.1 or later, and Thunderbird to version 45.5.1 or later. Refer to the Mozilla security advisory MFSA 2016-92 for official guidance.
- For Tor Browser users, ensure you are running the latest version of Tor Browser which includes the patched Firefox ESR base. Given the targeted nature of this exploit against Tor users, immediate updates are critical.
- Disable SVG rendering in email clients and browsers as an interim mitigation if patching is not immediately possible. In Thunderbird, set the mail.html_compose option to restrict HTML rendering capabilities.
- Monitor endpoint detection and response (EDR) solutions for indicators of compromise associated with SVG-based exploits, including unexpected memory access patterns, suspicious network connections from browser processes, or anomalous file access following web browsing activity.
- Implement network-level protections such as content filtering or proxy rules that inspect and block malicious SVG content, and ensure users are behind updated intrusion detection systems that include signatures for CVE-2016-9079.
Technical Details
CVE-2016-9079 is a use-after-free vulnerability that occurs during the processing of SVG Animation elements in Mozilla's Gecko rendering engine, shared by Firefox, Firefox ESR, and Thunderbird. The flaw arises when an SVG animation object is freed from memory but a dangling reference to that memory region persists, allowing subsequent operations to read from or operate on the freed memory location. Attack vector (Network): An attacker can exploit this vulnerability remotely by serving malicious SVG content through a web page, email, or any other content delivery mechanism that triggers Gecko's SVG parser. Attack complexity (Low): The exploit requires only that the victim's browser render the crafted SVG content, with no special conditions or race conditions needed. Privileges required (None) and User interaction (None): The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects that the vulnerability can be triggered without authentication and without explicit user action beyond normal browsing. The exploit discovered in the wild specifically targeted Windows users of Firefox and Tor Browser, leveraging the memory read capability to extract system identification data and de-anonymize Tor users.
Frequently Asked Questions
Is CVE-2016-9079 being actively exploited?
Yes, CVE-2016-9079 was discovered being actively exploited in the wild, specifically targeting Firefox and Tor Browser users on Windows. CISA has confirmed active exploitation by including it in the Known Exploited Vulnerabilities catalog. The EPSS score of 84.8% (99th percentile) indicates a very high probability of continued exploitation.
What products are affected by CVE-2016-9079?
CVE-2016-9079 affects Mozilla Firefox versions before 50.0.2, Firefox ESR versions before 45.5.1, and Mozilla Thunderbird versions before 45.5.1. The Tor Browser, which is based on Firefox ESR, was also specifically targeted. Distributions such as Debian Linux and Red Hat Enterprise Linux that ship these Mozilla products are affected as well.
How do I fix CVE-2016-9079?
Update Firefox to version 50.0.2 or later, Firefox ESR to version 45.5.1 or later, and Thunderbird to version 45.5.1 or later. Tor Browser users should ensure they are running the latest version. Refer to Mozilla security advisory MFSA 2016-92 for detailed guidance.
How severe is CVE-2016-9079?
CVE-2016-9079 has a CVSS score of 7.5 (High severity) under CVSS v3.1, with the primary impact being on confidentiality. While it does not allow code execution or data modification per its CVSS metrics, the real-world exploitation against Tor Browser users for de-anonymization demonstrates significant practical severity. Its EPSS score in the 99th percentile confirms it is among the most actively exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.