Mozilla has fixed two memory-related vulnerabilities in its Firefox browser that hackers were exploiting in the wild.
The bugs are fixed in Firefox 97.0.2, Firefox for Android 97.3.0, and version 81.6.1 of Firefox Extended Support Release (ESR), which is an enterprise version of the browser. They also affect Firefox Focus, the Foundation's privacy-focused mobile browser, and its Thunderbird mail client.
RELATED RESOURCE
The secure cloud configuration imperative
The central role of cloud security posture management
CVE-2022-26485 is a use-after-free bug, in which developers don't clear a pointer to a memory location after freeing that portion of memory.
That allows an attacker to use an error to hack the program. In this case, the bug lies with the implementation of Extensible Stylesheet Language Transformations (XSLT), which is a language for transforming XML documents into other document formats.
Removing an XSLT parameter during processing could lead to an exploit, Mozilla said. The National Vulnerability Database gives this bug a CVSS score of 9.8 (critical).
CVE-2022-26486 is also a use-after-free bug, this time in the WebGPU IPC Framework. WebGPU is a web API that lets the browser use the system's GPU for calculations and drawing complex images inside a web page. Unexpected input fed to the framework could allow an attacker to escape the sandbox designed to contain malicious activity, Mozilla's advisory warned. This bug got a CVSS score of 6.0 (medium).
Mozilla said that it had received reports of attacks in the wild exploiting both of these bugs. VulDB, a database that tracks and collates bug information, believes that an exploit of the WebGPU bug could fetch up to $25,000.
The Foundation attributed discovery of the bugs to researchers at Chinese security team Qihoo 360 ATA.
Mozilla has rushed to fix zero-day bugs in Firefox before. Two years ago it released patches for use-after-free vulnerabilities that it said attackers were exploiting in the wild.
-
Google CEO Sundar Pichai says vibe coding has made software development ‘exciting again’News Google CEO Sundar Pichai claims software development has become “exciting again” since the rise of vibe coding, but some devs are still on the fence about using AI to code.
-
15-year-old revealed as key player in Scattered LAPSUS$ HuntersNews 'Rey' says he's trying to leave Scattered LAPSUS$ Hunters and is prepared to cooperate with law enforcement
-
Security experts claim the CVE Program isn’t up to scratch anymore — inaccurate scores and lengthy delays mean the system needs updatedNews CVE data is vital in combating emerging threats, yet inaccurate ratings and lengthy wait times are placing enterprises at risk
-
IBM AIX users urged to patch immediately as researchers sound alarm on critical flawsNews Network administrators should patch the four IBM AIX flaws as soon as possible
-
Critical Dell Storage Manager flaws could let hackers access sensitive data – patch nowNews A trio of flaws in Dell Storage Manager has prompted a customer alert
-
Flaw in Lenovo’s customer service AI chatbot could let hackers run malicious code, breach networksNews Hackers abusing the Lenovo flaw could inject malicious code with just a single prompt
-
Industry welcomes the NCSC’s new Vulnerability Research Initiative – but does it go far enough?News The cybersecurity agency will work with external researchers to uncover potential security holes in hardware and software
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
