Mozilla Firefox 117: 5 High-Severity Vulnerabilities Patched

With the delivery of Mozilla Firefox 117, 13 vulnerabilities are patched, along with seven ‘Excessive Severity’ flaws and four memory corruption flaws.

Mozilla acknowledged that IPC CanvasTranslator, IPC ColorPickerShownCallback, IPC FilePickerShownCallback, and JIT UpdateRegExpStatics parts of the browser are all tormented by these memory corruption concerns, which can presumably consequence in doubtlessly exploitable crashes.

Excessive-Severity Flaws Addressed

The high severity flaw tracked as CVE-2023-4573, Reminiscence corruption in IPC CanvasTranslator, reported by Sonakkbi has been addressed.

When receiving rendering data thru IPC, mStream could presumably just non-public been initialized and then destroyed, which can presumably non-public resulted in a use-after-free and a atomize that could presumably just non-public been exploited.

Reminiscence corruption in IPC ColorPickerShownCallback tracked as CVE-2023-4574 has been mounted. The field modified into as soon as reported by Sonakkbi.

“When constructing a callback over IPC for exhibiting the Color Picker window, a pair of of the identical callbacks could presumably non-public been created at a time and at last all concurrently destroyed as soon as one in all the callbacks performed,” Mozilla acknowledged in its advisory.

A high-severity Reminiscence corruption worm in IPC FilePickerShownCallback tracked as CVE-2023-4575 has been addressed. The field modified into as soon as reported by Sonakkbi.

Lots of instances of identical callbacks could presumably non-public been produced straight away, and at last, all non-public been eliminated concurrently as soon as one in all the callbacks ended when generating a callback over IPC for exhibiting the File Picker window.

The flaw tracked as CVE-2023-4576, Integer Overflow in RecordedSourceSurfaceCreation has been mounted, reported by fffvr.

“On Windows, an integer overflow could presumably happen in RecordedSourceSurfaceCreation, which resulted in a heap buffer overflow doubtlessly leaking mild data that could presumably non-public resulted in a sandbox escape,” Mozilla acknowledged.

Most attention-grabbing Firefox for Windows is impacted by this field. Unaffected are a complete lot of working methods.

The Excessive-severity flaw tracked as CVE-2023-4577, Reminiscence corruption in JIT UpdateRegExpStatics modified into as soon as reported by Lukas Bernhard.

When UpdateRegExpStatics tried to retrieve initialStringHeap, it could perchance presumably non-public already been garbage composed sooner than entering the vogue, doubtlessly ensuing in an exploitable atomize.

The high-severity flaw modified into as soon as tracked as CVE-2023-4584; memory safety bugs mounted in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 non-public been reported by Randell Jesup, Andrew McCreight, the Mozilla Fuzzing Crew.

At last, the vulnerability tracked as CVE-2023-4585, Reminiscence safety bugs non-public been mounted in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2.

This field modified into as soon as reported by Donal Meehan, Sebastian Hengst, and the Mozilla Fuzzing Crew.

“These forms of bugs showed proof of memory corruption and we presume that with sufficient effort all these could presumably non-public been exploited to hotfoot arbitrary code”, Mozilla reports.

Six concerns non-public been mounted on this browser substitute ‘moderate’ and ‘low-severity’ flaws that could presumably allow for set aside of dwelling spoofing, the disclosure of non-public data, the unauthorized download of recordsdata, and a buffer overflow.

Mozilla printed the delivery of Firefox ESR 115.2, which accommodates updates for 14 vulnerabilities, 12 of which non-public been mounted in Firefox 117.

Withhold told about basically the most up to the moment Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.