Multiple Vulnerabilities in Mozilla Firefox and SeaMonkey Could Allow for Remote Code Execution
MS-ISAC ADVISORY NUMBER:2015-032
Multiple vulnerabilities have been identified in Mozilla Firefox and SeaMonkey which could allow for remote code execution. Mozilla Firefox is a web browser used to access the Internet and SeaMonkey is an all-in-one set of programs used for accessing the internet. Successful exploitation of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.
There are currently no reports of these vulnerabilities being exploited in the wild.
- Mozilla Firefox versions prior to 36.0.3
- Firefox versions prior ESR 31.5.2
- SeaMonkey versions prior 2.33.1
- Large and medium government entities: HIGH
- Small government entities: HIGH
- Large and medium business entities: HIGH
- Small business entities: HIGH
Two Vulnerabilities have been reported in Mozilla Firefox and SeaMonkey. Details of the vulnerabilities are as follows:
A privilege-escalation vulnerability using SVG format content navigation processing. This processing can be used by the attacker to bypass the same-origin policy and then remotely execute arbitrary code on the system. (CVE-2015-0818)
We recommend the following actions be taken:
Upgrade to latest versions of Mozilla Firefox and SeaMonkey.
Run all software as a non-privileged user to diminish effects of a successful attack.