CVE-2016-9079

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

• CWE-416
• CWE-416

• http://rhn.redhat.com/errata/RHSA-2016-2843.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2850.htmlThird Party Advisory
• http://www.securityfocus.com/bid/94591Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037370Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1321066Exploit, Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/201701-15Third Party Advisory
• https://security.gentoo.org/glsa/201701-35Third Party Advisory
• https://www.debian.org/security/2016/dsa-3730Third Party Advisory
• https://www.exploit-db.com/exploits/41151/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42327/Exploit, Third Party Advisory, VDB Entry
• https://www.mozilla.org/security/advisories/mfsa2016-92/Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2843.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2850.htmlThird Party Advisory
• http://www.securityfocus.com/bid/94591Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037370Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1321066Exploit, Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/201701-15Third Party Advisory
• https://security.gentoo.org/glsa/201701-35Third Party Advisory
• https://www.debian.org/security/2016/dsa-3730Third Party Advisory
• https://www.exploit-db.com/exploits/41151/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42327/Exploit, Third Party Advisory, VDB Entry
• https://www.mozilla.org/security/advisories/mfsa2016-92/Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079US Government Resource

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9073WebExtensions can bypass security checks to load privileged …
• CVE-2016-9074An existing mitigation of timing side-channel attacks is ins…
• CVE-2016-9075An issue where WebExtensions can use the mozAddonManager API…
• CVE-2016-9076An issue where a "<select>" dropdown menu can be used to cov…
• CVE-2016-9077Canvas allows the use of the "feDisplacementMap" filter on i…
• CVE-2016-9078Redirection from an HTTP connection to a "data:" URL assigns…
• CVE-2016-9080Memory safety bugs were reported in Firefox 50.0.2. Some of …
• CVE-2016-9081Joomla! 3.4.4 through 3.6.3 allows attackers to reset userna…
• CVE-2016-9082Integer overflow in the write_png function in cairo 1.14.6 a…
• CVE-2016-9083drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.…7.8
• CVE-2016-9084drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel throug…
• CVE-2016-9085Multiple integer overflows in libwebp allows attackers to ha…3.3