Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-06-22
• EPSS: 87% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

CISA: Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 13 Jul 2023): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• rhn.redhat.com/errata/RHSA-2016-2843.htmlThird Party Advisory
• rhn.redhat.com/errata/RHSA-2016-2850.htmlThird Party Advisory
• www.securityfocus.com/bid/94591Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/id/1037370Third Party AdvisoryVDB Entry
• bugzilla.mozilla.org/show_bug.cgiExploitIssue TrackingVendor Advisory
• security.gentoo.org/glsa/201701-15Third Party Advisory
• security.gentoo.org/glsa/201701-35Third Party Advisory
• www.debian.org/security/2016/dsa-3730Third Party Advisory
• www.exploit-db.com/exploits/41151ExploitThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/42327ExploitThird Party AdvisoryVDB Entry
• www.mozilla.org/security/advisories/mfsa2016-92Vendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource