tagline: Confidence in the Connected World
CIS Logo
HomeResourcesAdvisoriesMultiple Vulnerabilities in Mozilla Firefox and SeaMonkey Could Allow for Remote Code Execution

Multiple Vulnerabilities in Mozilla Firefox and SeaMonkey Could Allow for Remote Code Execution

MS-ISAC ADVISORY NUMBER:

2015-032

DATE(S) ISSUED:

03/22/2015

OVERVIEW:

Multiple vulnerabilities have been identified in Mozilla Firefox and SeaMonkey which could allow for remote code execution. Mozilla Firefox is a web browser used to access the Internet and SeaMonkey is an all-in-one set of programs used for accessing the internet. Successful exploitation of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.

THREAT INTELLIGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

  • Mozilla Firefox versions prior to 36.0.3
  • Firefox versions prior ESR 31.5.2
  • SeaMonkey versions prior 2.33.1

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: HIGH
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: HIGH
Home Users:
HIGH

TECHNICAL SUMMARY:

Two Vulnerabilities have been reported in Mozilla Firefox and SeaMonkey. Details of the vulnerabilities are as follows:

A remote-code execution vulnerability with the use of an out-of-bounds read/write error. This vulnerability occurs due to an error in the implementation of the Javascript just-in-time compilation’s typed array bounds checking. Once exploited, an attacker can run arbitrary code remotely as the logged on user or cause denial-of-service conditions. (CVE-2015-0817)

A privilege-escalation vulnerability using SVG format content navigation processing. This processing can be used by the attacker to bypass the same-origin policy and then remotely execute arbitrary code on the system. (CVE-2015-0818)

RECOMENDATIONS:

We recommend the following actions be taken:

Upgrade to latest versions of Mozilla Firefox and SeaMonkey.
Run all software as a non-privileged user to diminish effects of a successful attack.

REFERENCES:

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories