CVE-2016-9079: high-severity vulnerability in Mozilla Firefox
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Firefox has a use-after-free vulnerability in SVG Animation that allows attackers to crash the browser or execute arbitrary code. This flaw is actively being exploited against Windows users.
A use-after-free vulnerability in SVG Animation processing allows an attacker to access freed memory through malicious SVG content, potentially leading to code execution. The vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1 on Windows systems, with active exploitation documented in the wild.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.