Multiple Vulnerabilities in Mozilla Firefox and SeaMonkey Could Allow for Remote Code Execution

ITS Advisory Number: 
2015-031
Date(s) Issued: 
Monday, March 23, 2015
Subject: 
Multiple Vulnerabilities in Mozilla Firefox and SeaMonkey Could Allow for Remote Code Execution
Overview: 
Multiple vulnerabilities have been identified in Mozilla Firefox and SeaMonkey which could allow for remote code execution. Mozilla Firefox is a web browser used to access the Internet and SeaMonkey is an all-in-one set of programs used for accessing the internet. Successful exploitation of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.
Systems Affected: 
  • Mozilla Firefox versions prior to 36.0.3
  • Firefox versions prior ESR 31.5.2
  • SeaMonkey versions prior 2.33.1
RISK
GOVERNMENT
Large and medium government entities: 
High
Small government entities: 
High
BUSINESS
Large and medium business entities: 
High
Small business entities: 
High
Home Users: 
High
Description: 

Two Vulnerabilities have been reported in Mozilla Firefox and SeaMonkey. Details of the vulnerabilities are as follows:

  • A remote-code execution vulnerability with the use of an out-of-bounds read/write error. This vulnerability occurs due to an error in the implementation of the Javascript just-in-time compilation's typed array bounds checking. Once exploited, an attacker can run arbitrary code remotely as the logged on user or cause denial-of-service conditions. (CVE-2015-0817)
  • A privilege-escalation vulnerability using SVG format content navigation processing. This processing can be used by the attacker to bypass the same-origin policy and then remotely execute arbitrary code on the system. (CVE-2015-0818)

Successful exploitation of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.

 

Actions: 

We recommend the following actions be taken:

  • Apply appropriate patches provided by Mozilla to vulnerable systems immediately after appropriate testing.
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.