How to Fix CVE-2016-9079: Use After Free in Firefox

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Update Firefox, Firefox ESR, or Thunderbird now. The fix is built into Firefox 50.0.2, Firefox ESR 45.5.1, and Thunderbird 45.5.1. This was a live zero-day used to de-anonymize Tor Browser users, so there is no safe wait. CISA KEV entry added 2023-06-22, federal due date 2023-07-13.

What is CVE-2016-9079?

CVE-2016-9079 is a use-after-free flaw (CWE-416) in the SVG Animation code inside Mozilla's Gecko engine. When a page drives an animated SVG element in a specific order, the layout code keeps using a heap object after it has already been freed. An attacker who controls that freed memory can steer the dangling pointer at attacker-chosen data and ultimately run native code in the browser process. Because the trigger is plain markup and script rendered by the page, the victim only has to open a malicious web page. No clicks, no add-ons, no privilege escalation on the host needed first.

The affected products are Mozilla Firefox before 50.0.2, Firefox ESR before 45.5.1, and Thunderbird before 45.5.1. The bug lives in the shared rendering engine, which is why the mail client Thunderbird is on the list alongside the browsers: it renders HTML and SVG the same way Firefox does.

This is a client-side browser and mail-client vulnerability. It is not a server package, a daemon, or a container service. The thing you patch is the desktop application a person runs, on whatever machine they browse from.

Why this CVE matters

This was not a theoretical proof of concept. The exploit was caught live in November 2016, served from a hidden service, and built to unmask Tor Browser users (which is Firefox ESR under the hood) running on Windows. The payload collected the victim's real IP and MAC address and phoned home, the same de-anonymization pattern security researchers had seen in the 2013 Firefox attack. Mozilla shipped 50.0.2 within roughly a day of the report. The Tor Project pushed a matching Tor Browser update on the same cycle.

CISA later placed CVE-2016-9079 on the Known Exploited Vulnerabilities catalog (2023-06-22), confirming on record what the 2016 incident already showed: real attackers used this to compromise endpoints. A single visit to a hostile page was enough to run code as the user. If you still run any build in the affected range, treat it as exploitable today.

Am I affected?

Check the version inside the application, not a package database. In Firefox or Thunderbird open the menu and go to Help → About. If you are below the fixed build for your channel, you are vulnerable:

• Firefox (rapid release): any version below 50.0.2.
• Firefox ESR: any version below 45.5.1 (this includes the Tor Browser builds from that era).
• Thunderbird: any version below 45.5.1.

For fleet visibility you can read the application's own version string rather than relying on an OS package manager, since many users run vendor builds installed outside the system repos:

# Windows: read the actual Firefox/Thunderbird build version
(Get-Item "C:\Program Files\Mozilla Firefox\firefox.exe").VersionInfo.ProductVersion
(Get-Item "C:\Program Files\Mozilla Thunderbird\thunderbird.exe").VersionInfo.ProductVersion

# Linux: ask the binary directly
firefox --version
thunderbird --version

How to fix CVE-2016-9079

The fix is to update to a build that contains the patch. There is no configuration workaround that fully closes the bug, and disabling JavaScript only narrows the attack surface. Update to at least the version named for your channel.

Firefox and Thunderbird: built-in updater

On a normal desktop install, the application updates itself. Force it now rather than waiting for the background check:

1. Open the menu (the three-line button), then Help → About Firefox (or About Thunderbird).
2. The About dialog checks for updates and downloads the patched build automatically.
3. Click Restart to update when prompted, then reopen the About dialog and confirm the version is at least 50.0.2 (Firefox), 45.5.1 (ESR), or 45.5.1 (Thunderbird).

If automatic updates were disabled by policy, download the current installer directly from mozilla.org and run it over the existing install. Since this bug was patched in 2016, the current shipping release is far newer and already includes the fix.

Tor Browser

Tor Browser is built on Firefox ESR, so it was vulnerable too. Open the menu and choose Help → About Tor Browser, or use the onion-menu update check, and let it pull the current build. Do not keep browsing on an old Tor Browser: the live 2016 exploit specifically targeted Tor users, and de-anonymization is the whole point of that attack.

Windows: managed / enterprise deployments

If you push Firefox ESR with an MSI through SCCM, Intune, or GPO, deploy the patched MSI and let the installer replace the old build in place. Mozilla's enterprise MSI installers are published per channel; target the ESR 45.5.1-or-later line for managed estates and the rapid-release 50.0.2-or-later line for standalone installs.

# Silent in-place upgrade from the patched Mozilla MSI
Start-Process msiexec.exe -ArgumentList '/i "C:\Deploy\Firefox Setup.msi" /qn /norestart' -Wait

# Confirm the running build is patched
(Get-Item "C:\Program Files\Mozilla Firefox\firefox.exe").VersionInfo.ProductVersion

Linux: distribution package

If you installed Firefox or Thunderbird from your distro's repository, the security update is delivered through the package manager. The vendor advisories that backported the fix are Debian DSA-3730, Red Hat RHSA-2016:2843 / RHSA-2016:2850, and Gentoo GLSA-201701-35. Pull the update and confirm the version:

# Debian / Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade firefox-esr thunderbird
firefox-esr --version

# RHEL / Rocky / Alma
sudo dnf upgrade --refresh firefox thunderbird
firefox --version

Distro package names vary (Debian ships firefox-esr; some distros call it firefox). Match the name to what is actually installed. After any update, fully close and reopen the application so the old process is gone and the patched binary is the one running.

If you can't update right away

There is no registry key or service flag that removes this bug, because Firefox is not a Windows service and the flaw is in the rendering engine itself. The only meaningful stopgaps reduce the chance the exploit fires:

• Disable JavaScript on untrusted sites. The original exploit chained SVG with script; turning off JavaScript (or using NoScript, which Tor Browser ships) blocks the common trigger path. This breaks most modern sites, so it is a bridge, not a destination.
• Stop browsing from the affected build. If a machine cannot be updated, do not use its old Firefox/Thunderbird to open web content or HTML mail until it is patched.
• For Thunderbird, keep remote content and scripting in messages disabled so a malicious HTML email cannot drive the SVG path.

Confirm the fix landed

After updating, reopen Help → About and read the version. It must be at least the fixed build for the channel:

# Linux: verify the patched version is what runs
firefox --version       # expect 50.0.2+ (or ESR 45.5.1+)
thunderbird --version   # expect 45.5.1+

# Windows: verify the on-disk build
(Get-Item "C:\Program Files\Mozilla Firefox\firefox.exe").VersionInfo.ProductVersion

For a managed estate, run an authenticated scan and confirm the scanner no longer flags CVE-2016-9079 on the endpoint. Because the live exploit ran code as the user and harvested host identifiers, any machine that browsed the wider web on an unpatched build during the exposure window should be reviewed for unexpected outbound connections and treated as potentially compromised.

Frequently asked questions

What version of Firefox fixes CVE-2016-9079?

Firefox 50.0.2 contains the fix for the rapid-release channel. On the extended support line it is Firefox ESR 45.5.1, and for the mail client it is Thunderbird 45.5.1. Any build at or above those numbers is patched.

Is this a server vulnerability I patch with apt or yum on a server?

No. CVE-2016-9079 affects the desktop browser and mail client a person runs, not a server daemon. You patch it by updating the Firefox, Firefox ESR, Thunderbird, or Tor Browser application on each endpoint. If those apps came from a distro repo, the package manager delivers the update, but the thing being fixed is still the client application.

Does this affect Tor Browser?

Yes. Tor Browser is built on Firefox ESR, and the in-the-wild 2016 exploit specifically targeted Tor users on Windows to reveal their real IP and MAC address. Update Tor Browser to the build that shipped alongside Firefox ESR 45.5.1 or later.

Is there a public exploit?

Yes. The original attack code was captured in the wild and the technique is documented publicly, including entries on Exploit-DB. Combined with the CISA KEV listing, that means working exploitation is real and not hypothetical. Update without delay.

References

• Official Mozilla advisory (MFSA2016-92): https://www.mozilla.org/security/advisories/mfsa2016-92/
• Mozilla bug 1321066: https://bugzilla.mozilla.org/show_bug.cgi?id=1321066
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2016-9079
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079
• Debian advisory DSA-3730: https://www.debian.org/security/2016/dsa-3730
• Red Hat advisory RHSA-2016:2843: http://rhn.redhat.com/errata/RHSA-2016-2843.html
• Gentoo advisory GLSA-201701-35: https://security.gentoo.org/glsa/201701-35
• Exploit-DB entry: https://www.exploit-db.com/exploits/42327/

This guide was assembled from the Mozilla advisory MFSA2016-92, the upstream MITRE/NVD record, and the CISA KEV catalog entry. Always confirm against the Mozilla advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2016-3235: DLL side-loading in Microsoft Office Visio
• How to Fix CVE-2016-7836: Remote Code Execution in SKYSEA Client View
• How to Fix CVE-2016-10033: Command Injection in PHPMailer
• How to Fix CVE-2016-3715: Arbitrary file deletion in ImageMagick
• How to Fix CVE-2016-3714: Security Vulnerability in ImageMagick