CVE-2016-9079 Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free

Q: Is CVE-2016-9079 being exploited?

Yes. Attackers have exploited CVE-2016-9079 in the wild since at least 22 Jun 2023.

Q: How do I fix CVE-2016-9079?

Upgrade to a fixed version. US federal agencies must fix it by 13 Jul 2023.

Exploited in the wild High 7.5 Published 11 Jun 2018 Updated 21 Oct 2025

A use-after-free flaw in SVG Animation allows remote attackers to execute arbitrary code via crafted web content, affecting Firefox and Thunderbird users.

Exploited in the wild: Since 22 Jun 2023
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-9079?

CVE-2016-9079 is a high-severity use after free vulnerability in Debian Debian Linux, published on 11 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

Weakness: CWE-416

Which versions are affected by CVE-2016-9079?

It affects 10 products.

Linux distribution packages (40)

`firefox` Red Hat:enterprise_linux:5::client	All versions	`0:45.5.1-1.el5_11`
`firefox-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:45.5.1-1.el5_11`
`thunderbird` Red Hat:enterprise_linux:5::client	All versions	`0:45.5.1-1.el5_11`
`thunderbird-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:45.5.1-1.el5_11`
`firefox` Red Hat:enterprise_linux:5::server	All versions	`0:45.5.1-1.el5_11`
`firefox-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:45.5.1-1.el5_11`
`firefox` Red Hat:enterprise_linux:6::client	All versions	`0:45.5.1-1.el6_8`
`firefox-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:45.5.1-1.el6_8`
`thunderbird` Red Hat:enterprise_linux:6::client	All versions	`0:45.5.1-1.el6_8`
`thunderbird-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:45.5.1-1.el6_8`
`firefox` Red Hat:enterprise_linux:6::computenode	All versions	`0:45.5.1-1.el6_8`
`firefox-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:45.5.1-1.el6_8`
`firefox` Red Hat:enterprise_linux:6::server	All versions	`0:45.5.1-1.el6_8`
`firefox-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:45.5.1-1.el6_8`
`thunderbird` Red Hat:enterprise_linux:6::server	All versions	`0:45.5.1-1.el6_8`
`thunderbird-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:45.5.1-1.el6_8`
`firefox` Red Hat:enterprise_linux:6::workstation	All versions	`0:45.5.1-1.el6_8`
`firefox-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:45.5.1-1.el6_8`
`thunderbird` Red Hat:enterprise_linux:6::workstation	All versions	`0:45.5.1-1.el6_8`
`thunderbird-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:45.5.1-1.el6_8`
`firefox` Red Hat:enterprise_linux:7::client	All versions	`0:45.5.1-1.el7_3`
`firefox-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:45.5.1-1.el7_3`
`thunderbird` Red Hat:enterprise_linux:7::client	All versions	`0:45.5.1-1.el7_3`
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:45.5.1-1.el7_3`
`firefox` Red Hat:enterprise_linux:7::server	All versions	`0:45.5.1-1.el7_3`
`firefox-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:45.5.1-1.el7_3`
`thunderbird` Red Hat:enterprise_linux:7::server	All versions	`0:45.5.1-1.el7_3`
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:45.5.1-1.el7_3`
`firefox` Red Hat:enterprise_linux:7::workstation	All versions	`0:45.5.1-1.el7_3`
`firefox-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:45.5.1-1.el7_3`
`thunderbird` Red Hat:enterprise_linux:7::workstation	All versions	`0:45.5.1-1.el7_3`
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:45.5.1-1.el7_3`
`thunderbird` Red Hat:rhel_productivity:5	All versions	`0:45.5.1-1.el5_11`
`thunderbird-debuginfo` Red Hat:rhel_productivity:5	All versions	`0:45.5.1-1.el5_11`
`MozillaFirefox` SUSE:Linux Enterprise Desktop 12 SP1	All versions	`45.5.1esr-93.1`
`MozillaFirefox` SUSE:Linux Enterprise Desktop 12 SP2	All versions	`45.5.1esr-93.1`
`MozillaFirefox` SUSE:Linux Enterprise Server 12 SP1	All versions	`45.5.1esr-93.1`
`MozillaFirefox` SUSE:Linux Enterprise Server 12 SP2	All versions	`45.5.1esr-93.1`
`MozillaFirefox` SUSE:Linux Enterprise Server 12-LTSS	All versions	`45.5.1esr-93.1`
`MozillaFirefox` SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2	All versions	`45.5.1esr-93.1`

Products include Debian Debian Linux, Mozilla Firefox, Mozilla Thunderbird, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 4 more.

How do I fix CVE-2016-9079?

Upgrade to a fixed version. US federal agencies must fix it by 13 Jul 2023.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2016-9079 being exploited?

Yes. Attackers have exploited CVE-2016-9079 in the wild since at least 22 Jun 2023.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 4 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-9079, DSA-3728-1, GHSA-cmgc-v5fc-wx68, MGASA-2016-0410, RHSA-2016:2843, RHSA-2016:2850 and 2 more.