SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2016-9079

Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

KEVHIGH 7.5EPSS 87.4%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 13 July 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

CVSS 3.1
7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
87.42% probability · 100th percentile
CISA KEV
Listed 22 June 2023 · due 13 July 2023
Weakness
CWE-416
Affected
debian/debian linux · redhat/enterprise linux · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server eus · redhat/enterprise linux workstation · mozilla/thunderbird · mozilla/firefox · torproject/tor
Source
security@mozilla.org

CISA notes

Apply updates per vendor instructions. https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079; https://nvd.nist.gov/vuln/detail/CVE-2016-9079

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.