A Mozilla Foundation Security Advisory was released yesterday detailing the security vulnerabilities that have been fixed in the latest Firefox update. Firefox 107 contains security fixes to 8 high severity vulnerabilities that impact previous versions of this product. These include three use-after-free vulnerabilities in InputStream (CVE-2022-45405), JavaScript Realm (CVE-2022-45406), and Garbage Collection (CVE-2022-45409), and a potential use-after-free vulnerability (CVE-2022-45407) based on font loading on background workers in a non-thread-safe environment.
Also included where two full screen notification bypasses using window.print (CVE-2022-45404) and windowName (CVE-2022-45408), and a vulnerability with the possibility for service workers to learn information from cross-origin media files that they should have been unable to access (CVE-2022-45403). A memory safety bug (CVE-2022-45421) has also been fixed in this update, as well as in Firefox ESR 102.5. This vulnerability shows some evidence of memory corruption, which could be exploited by attackers to run arbitrary code.
Another use-after-free vulnerability tracked as CVE-2022-40674 has been found to have moderate impact by Mozilla, however this flaw has previously been categorised as a critical severity vulnerability, and assigned a CVSS base score of 9.8. This flaw occurs in the XML parsing process, where an XML document is read, and an interface is provided for the user application to be able to access the document. A potential exploit of this vulnerability can attempt to reference freed memory, resulting in a crash of the application, which attackers can potentially further exploit.
Although Mozilla have rated this a lower severity vulnerability, and NIST’s National Vulnerability Database state that “this vulnerability has been modified and is currently undergoing reanalysis”, Microsoft 365 Defender has identified this vulnerability as critical within it’s ‘New Vulnerabilities Notification’ programme, and alerted users of any potentially exposed devices on their system. No workaround is listed for this vulnerability, instead users should update to Firefox 107 where this vulnerability has been mitigated through WebAssembly (Wasm) sandboxing.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)