Lucene search

K
kasperskyKaspersky LabKLA20169
HistoryJan 17, 2023 - 12:00 a.m.

KLA20169 Multiple vulnerabilities in Mozilla Firefox ESR

2023-01-1700:00:00
Kaspersky Lab
threats.kaspersky.com
13
mozilla firefox esr
ui spoofing
security bypass
arbitrary code execution
osi
sb
sui
cve-2022-46877
cve-2022-46871
cve-2023-23602
cve-2023-23598
cve-2023-23599
cve-2023-23605
cve-2023-23603
cve-2023-23601
ace
gtk drag and drop
webworker
libusrsctp
devtools

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

0.003

Percentile

72.0%

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to spoof user interface, bypass security restrictions, execute arbitrary code.

Below is a complete list of vulnerabilities:

  1. Security UI vulnerability in Fullscreen notification can be exploited to spoof user interface.
  2. Security bypass vulnerability in libusrsctp can be exploited to bypass security restrictions.
  3. Security vulnerability in WebWorker can be exploited to bypass security restrictions.
  4. Code execution vulnerability in GTK drag and drop can be exploited remotely to execute arbitrary code.
  5. Code execution vulnerability in Devtools can be exploited remotely to execute arbitrary code.
  6. Memory safety vulnerability can be exploited to execute arbitrary code.
  7. Security vulnerability in format directive can be exploited to bypass security restrictions.
  8. Security UI vulnerability in cross-origin iframe can be exploited to spoof user interface.

Original advisories

MFSA2023-02

Related products

Mozilla-Firefox-ESR

CVE list

CVE-2022-46877 warning

CVE-2022-46871 critical

CVE-2023-23602 high

CVE-2023-23598 high

CVE-2023-23599 high

CVE-2023-23605 critical

CVE-2023-23603 high

CVE-2023-23601 high

Solution

Update to the latest version

Download Firefox ESR

Impacts

  • ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

  • OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

  • SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

  • SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

  • Mozilla Firefox ESR earlier than 102.7

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

0.003

Percentile

72.0%