CVE-2016-9079
published 2018-06-11CVE-2016-9079: A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox…
PriorityP187high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-07-13
Exploited in the wild
EPSS
87.60%
99.7th percentile
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | firefox | < firefox 50.0.2-1 (sid) | firefox 50.0.2-1 (sid) |
| debian | firefox-esr | < firefox 50.0.2-1 (sid) | firefox 50.0.2-1 (sid) |
| mozilla | firefox | < 50.0.2 | 50.0.2 |
| mozilla | firefox | < 45.5.1 | 45.5.1 |
| mozilla | firefox | >= 0 < 50.0.2+build1-0ubuntu0.14.04.1 | 50.0.2+build1-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 50.0.2+build1-0ubuntu0.16.04.1 | 50.0.2+build1-0ubuntu0.16.04.1 |
| mozilla | firefox | >= unspecified < 50.0.2 | 50.0.2 |
| mozilla | firefox_esr | >= unspecified < 45.5.1 | 45.5.1 |
| mozilla | thunderbird | < 45.5.1 | 45.5.1 |
| mozilla | thunderbird | >= 0 < 1:45.5.1+build1-0ubuntu0.14.04.1 | 1:45.5.1+build1-0ubuntu0.14.04.1 |
| mozilla | thunderbird | >= 0 < 1:45.5.1+build1-0ubuntu0.16.04.1 | 1:45.5.1+build1-0ubuntu0.16.04.1 |
| mozilla | thunderbird | >= unspecified < 45.5.1 | 45.5.1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0xa8909090 (JIT-spray NOP sled constant)
- →Exploit targets Firefox and Tor Browser on Windows only; filter by Windows User-Agent strings containing 'Firefox' to identify targeted traffic ↗
- →Exploit delivery uses HTTP responses with 'Pragma: no-cache' and 'Cache-Control: no-cache' headers alongside 'Content-Type: text/html'; monitor for exploit pages served with these combined headers ↗
- →Worker JS payload is served with Content-Type: application/javascript and no-cache headers; detect requests to worker.js paths from browser exploit chains ↗
- →ASM.JS JIT-spray uses repeated addition of constant 0xa8909090 to create a NOP sled in JIT-compiled memory; detect large asm.js modules with repetitive arithmetic on this constant ↗
- →Exploit uses a Web Worker spawned via a data: URI with JavaScript MIME type as part of the trigger mechanism ↗
- →Vulnerable function is nsSMILTimeContainer::NotifyTimeChange(); monitor crash dumps or AV detections referencing this symbol ↗
- ·Exploit is Windows-only and targets x86 architecture; the Metasploit module explicitly restricts to ARCH_X86 on Windows ↗
- ·Affected versions are Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1; detections should be scoped to these versions ↗
- ·The heap spray offset 0x88 is hardcoded for Firefox 50.0.1 specifically; different Firefox versions may require different offsets ↗
- ·The Metasploit module uses post-exploitation migration by default; defenders should expect process migration activity following successful exploitation ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv9.8CRITICAL
vulncheck7.5HIGH
cisa7.5HIGH
vendor_ubuntu9.8CRITICAL
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
cisa·2023-06-22·CVSS 7.5
CVE-2016-9079 [HIGH] CWE-416 Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
Vulnerability: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
Affected: Mozilla Firefox, Firefox ESR, and Thunderbird
Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.
Required Action: Apply updates per vendor instructions.
Notes: https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079; https://nvd.nist.gov/vuln/detail/CVE-2016-9079
Remediation Due Date: 2023-07-13
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2016-12-01·CVSS 9.8
CVE-2016-5290 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Christian Holler, Jon Coppeard, Olli Pettay, Ehsan Akhgari, Gary Kwong,
Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues
in Thunderbird. If a user were tricked in to opening a specially crafted
message, an attacker could potentially exploit these to cause a denial of
service via application crash, or execute arbitrary code. (CVE-2016-5290)
A same-origin policy bypass was discovered with local HTML files in some
circumstances. An attacker could potentially exploit this to obtain
sensitive information. (CVE-2016-5291)
A heap buffer-overflow was discovered in Cairo when processing SVG
content. If a user were tricked in to opening a specially crafted message,
an attacker
Red Hat
Mozilla: Firefox SVG Animation Remote Code Execution (MFSA 2016-92)
vendor_redhat·2016-12-01·CVSS 7.5
CVE-2016-9079 [HIGH] Mozilla: Firefox SVG Animation Remote Code Execution (MFSA 2016-92)
Mozilla: Firefox SVG Animation Remote Code Execution (MFSA 2016-92)
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2016-11-30·CVSS 8.8
CVE-2016-9078 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
It was discovered that data: URLs can inherit the wrong origin after a
HTTP redirect in some circumstances. An attacker could potentially
exploit this to bypass same-origin restrictions. (CVE-2016-9078)
A use-after-free was discovered in SVG animations. If a user were tricked
in to opening a specially crafted website, an attacker could exploit this
to cause a denial of service via application crash, or execute arbitrary
code. (CVE-2016-9079)
Instructions: After a standard system update you need to restart Firefox to make
all the necessary changes.
Debian
CVE-2016-9079: firefox - A use-after-free vulnerability in SVG Animation has been discovered. An exploit ...
vendor_debian·2016·CVSS 7.5
CVE-2016-9079 [HIGH] CVE-2016-9079: firefox - A use-after-free vulnerability in SVG Animation has been discovered. An exploit ...
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
Scope: local
sid: resolved (fixed in 50.0.2-1)
GHSA
GHSA-cmgc-v5fc-wx68: A use-after-free vulnerability in SVG Animation has been discovered
ghsa_unreviewed·2022-05-14
CVE-2016-9079 [HIGH] CWE-416 GHSA-cmgc-v5fc-wx68: A use-after-free vulnerability in SVG Animation has been discovered
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
OSV
CVE-2016-9079: A use-after-free vulnerability in SVG Animation has been discovered
osv·2018-06-11·CVSS 7.5
CVE-2016-9079 [HIGH] CVE-2016-9079: A use-after-free vulnerability in SVG Animation has been discovered
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
Project0
The Great DOM Fuzz-off of 2017 - Project Zero
project_zero·2017-09-01·CVSS 7.5
CVE-2016-9079 [HIGH] The Great DOM Fuzz-off of 2017 - Project Zero
Posted by Ivan Fratric, Project Zero
##
Introduction
Historically, DOM engines have been one of the largest sources of web browser bugs. And while in the recent years the popularity of those kinds of bugs in targeted attacks has somewhat fallen in favor of Flash (which allows for cross-browser exploits) and JavaScript engine bugs (which often result in very powerful exploitation primitives), they are far from gone. For example, CVE-2016-9079 (a bug that was used in November 2016 against Tor Browser users) was a bug in Firefox’s DOM implementation, specifically the part that handles SVG elements in a web page. It is also a rare case that a vendor will publish a security update that doesn’t contain fixes for at least several DOM engine bugs.
An interesting property of many of those bugs
OSV
thunderbird vulnerabilities
osv·2016-12-01·CVSS 9.8
CVE-2016-5290 [CRITICAL] thunderbird vulnerabilities
thunderbird vulnerabilities
Christian Holler, Jon Coppeard, Olli Pettay, Ehsan Akhgari, Gary Kwong,
Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues
in Thunderbird. If a user were tricked in to opening a specially crafted
message, an attacker could potentially exploit these to cause a denial of
service via application crash, or execute arbitrary code. (CVE-2016-5290)
A same-origin policy bypass was discovered with local HTML files in some
circumstances. An attacker could potentially exploit this to obtain
sensitive information. (CVE-2016-5291)
A heap buffer-overflow was discovered in Cairo when processing SVG
content. If a user were tricked in to opening a specially crafted message,
an attacker could potentially exploit this to cause a denial of service
via app
OSV
firefox vulnerabilities
osv·2016-11-30·CVSS 8.8
CVE-2016-9078 [HIGH] firefox vulnerabilities
firefox vulnerabilities
It was discovered that data: URLs can inherit the wrong origin after a
HTTP redirect in some circumstances. An attacker could potentially
exploit this to bypass same-origin restrictions. (CVE-2016-9078)
A use-after-free was discovered in SVG animations. If a user were tricked
in to opening a specially crafted website, an attacker could exploit this
to cause a denial of service via application crash, or execute arbitrary
code. (CVE-2016-9079)
VulnCheck
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
vulncheck·2016·CVSS 7.5
CVE-2016-9079 [HIGH] CWE-416 Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.
Affected: Mozilla Firefox and Thunderbird
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.forbes.com/sites/thomasbrewster/2016/12/02/exodus-intel-the-company-that-exposed-tor-for-cops-child-porn-bust/?sh=2d4835cc5f8c; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/9171867a941e; https://vulncheck.com/xdb/ea2825280c25; https://vulncheck.com/xdb/f7a235807
No detection rules found.
Exploit-DB
Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution
exploitdb·2017-07-14·CVSS 7.5
CVE-2017-5375 [HIGH] Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution
Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution
---
function asm_js_module(){
"use asm";
/* huge jitted nop sled */
function payload_code(){
var val = 0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa8909090)|0;
val = (val + 0xa890
Exploit-DB
Mozilla Firefox < 50.0.2 - 'nsSMILTimeContainer::NotifyTimeChange()' Remote Code Execution (Metasploit)
exploitdb·2017-01-24
CVE-2016-9079 Mozilla Firefox < 50.0.2 - 'nsSMILTimeContainer::NotifyTimeChange()' Remote Code Execution (Metasploit)
Mozilla Firefox "Firefox nsSMILTimeContainer::NotifyTimeChange() RCE",
'Description' => %q{
This module exploits an out-of-bounds indexing/use-after-free condition present in
nsSMILTimeContainer::NotifyTimeChange() across numerous versions of Mozilla Firefox
on Microsoft Windows.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Anonymous Gaijin', # Original research/exploit
'William Webb ' # Metasploit module
],
'Platform' => 'win',
'Targets' =>
[
[ 'Mozilla Firefox',
{
'Platform' => 'win',
'Arch' => ARCH_X86,
}
],
],
'DefaultOptions' =>
{
'EXITFUNC' => "thread",
'InitialAutoRunScript' => 'migrate -f'
},
'References' =>
[
[ 'CVE', '2016-9079' ],
[ 'Bugzilla', '1321066' ]
],
'Arch' => ARCH_X86,
'DisclosureDate' => "Nov 30 2016",
'DefaultTarget' => 0
)
)
register_options(
[
OptBool.new('UsePostHT
Metasploit
Firefox nsSMILTimeContainer::NotifyTimeChange() RCE
metasploit
Firefox nsSMILTimeContainer::NotifyTimeChange() RCE
Firefox nsSMILTimeContainer::NotifyTimeChange() RCE
This module exploits an out-of-bounds indexing/use-after-free condition present in nsSMILTimeContainer::NotifyTimeChange() across numerous versions of Mozilla Firefox on Microsoft Windows.
Bugzilla
lack of executable-code quota allows full bypass of ASLR and DEP
bugzilla·2016-12-21
[CRITICAL] lack of executable-code quota allows full bypass of ASLR and DEP
lack of executable-code quota allows full bypass of ASLR and DEP
Created attachment 8820887
PoC for Firefox 50.1.0 (Release). Demonstrates point 2.1 in the report
asm.js allows to JIT-spray attacker controlled code, and hence, allows to fully
bypass ASLR and DEP in 32-bit (x86) Firefox (Tested versions: Release and
Nightly). As it is very easy to find, I do not know if it is already known (I
hope I do not reinvent the wheel here...)
In summary this means, that an attacker can exploit a memory corruption
vulnerability (such as an UAF) as if no ASLR and DEP existed. He only needs EIP
control and does not need any memory disclosures/info-leaks or code-reuse. That
makes exploitation of memory corruptions for an attacker super easy.
Consider following asm.js script:
function asm_js_modul
Bugzilla
CVE-2016-9079 Mozilla: Firefox SVG Animation Remote Code Execution (MFSA 2016-92)
bugzilla·2016-12-01·CVSS 7.5
CVE-2016-9079 [HIGH] CVE-2016-9079 Mozilla: Firefox SVG Animation Remote Code Execution (MFSA 2016-92)
CVE-2016-9079 Mozilla: Firefox SVG Animation Remote Code Execution (MFSA 2016-92)
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079
Acknowledgements:
Name: the Mozilla project
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
Via RHSA-2016:2843 https://rhn.redhat.com/errata/RHSA-2016-2843.html
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 6
Via RHSA-
http://rhn.redhat.com/errata/RHSA-2016-2843.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2850.htmlhttp://www.securityfocus.com/bid/94591http://www.securitytracker.com/id/1037370https://bugzilla.mozilla.org/show_bug.cgi?id=1321066https://security.gentoo.org/glsa/201701-15https://security.gentoo.org/glsa/201701-35https://www.debian.org/security/2016/dsa-3730https://www.exploit-db.com/exploits/41151/https://www.exploit-db.com/exploits/42327/https://www.mozilla.org/security/advisories/mfsa2016-92/http://rhn.redhat.com/errata/RHSA-2016-2843.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2850.htmlhttp://www.securityfocus.com/bid/94591http://www.securitytracker.com/id/1037370https://bugzilla.mozilla.org/show_bug.cgi?id=1321066https://security.gentoo.org/glsa/201701-15https://security.gentoo.org/glsa/201701-35https://www.debian.org/security/2016/dsa-3730https://www.exploit-db.com/exploits/41151/https://www.exploit-db.com/exploits/42327/https://www.mozilla.org/security/advisories/mfsa2016-92/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9079
2018-06-11
Published
2023-06-22
Added to CISA KEV
Exploited in the wild