Firefox: Important Advisory On High-Risk Memory Corruption And Malware

Firefox

The Discovery 

Multiple important security issues have been identified in Firefox. Memory safety bugs were found in Firefox 111 and Firefox ESR 102.9, some of which showed evidence of memory corruption (CVE-2023-29550). It was also discovered that the improper handling of downloads of files ending in .desktop can be interpreted to run attacker-controlled commands (CVE-2023-29541), and following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced (CVE-2023-29535). 

The Impact

These vulnerabilities could be used to trick users into installing malware, or result in potentially exploitable crashes, memory corruption, spoofing attacks, or the execution of arbitrary code.

The Fix

With a high confidentiality, integrity and availability impact, it is critical that all affected users apply the updates for Firefox issued but their distro(s) immediately to protect against attacks leading to downtime, compromise and malware-induced damage.

Your Related Advisories:

[distro_list_1]

Chromium

The Discovery 

Distros continue to release important updates mitigating several remotely exploitable vulnerabilities that were recently found in Chromium. These issues include a heap buffer overflow in Chrome prior to 112.0.5615.49 (CVE-2023-1810) and a use after free vulnerability in Frames in Chrome prior to 112.0.5615.49 (CVE-2023-1811). With a high confidentiality, integrity and availability impact, both of these vulnerabilities have been assigned a Chromium security severity of “High” and a National Vulnerability Database base score of 8.8 out of 10 (High severity).

The Impact

These issues could result in the execution of arbitrary code, denial of service (DoS) attacks resulting in potentially exploitable crashes, or the disclosure of sensitive information.

The Fix

With a low attack complexity and no user interaction or privileges required to exploit these bugs, it is crucial that all impacted users apply the Chromium security updates issued by their distro(s) as soon as possible to protect against exploits leading to downtime and the compromise of their systems and sensitive data.

Your Related Advisories:

[distro_list_2]

Linux Kernel

The Discovery 

Distros are still releasing advisory updates addressing several important security vulnerabilities that have been discovered in the Linux kernel. The most notable issues include the finding that the KVM VMX implementation in the kernel did not properly handle indirect branch prediction isolation between L1 and L2 VMs (CVE-2022-2196), and an integer overflow vulnerability in the RNDIS USB driver in the kernel (CVE-2023-23559).

The Impact

These bugs could lead to denial of service (DoS) attacks resulting in potentially exploitable crashes, the exposure of sensitive information, or the execution of arbitrary code.

The Fix

Important updates for the kernel that mitigate these flaws have been released. We strongly encourage all impacted users to apply the Linux kernel updates issued by their distro(s) now if they have not already to protect the confidentiality, integrity and availability of their systems and their sensitive information.

Your Related Advisories:

[distro_list_3]