# MA-465.042015: MyCERT Advisory - Mozilla Releases Security Updates for Firefox, Firefox ESR and Thunderbird

**Date:** 06 Apr 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-465.042015  
**Advisory ID:** MA-465.042015

---

#### **1.0 Introduction** Mozilla Foundation has released security updates to address multiple vulnerabilities in Firefox, Firefox ESR and Thunderbird. Mozilla encourages users and administrators to review Mozilla's Security Updates and apply the necessary updates.
**2.0 Impact**
The vulnerabilities impacting each software are listed below:
**Firefox**
- **Certificate verification bypass through the HTTP/2 Alt-Svc header –**
If an Alt-Svc header is specified in the HTTP/2 response, SSL certificate verification can be bypassed for the specified alternate server. As a result of this, warnings of invalid SSL certificates will not be displayed and an attacker could potentially impersonate another site through a man-in-the-middle (MTIM), replacing the original certificate with their own.
- **Loading privileged content through Reader mode** –
a flaw in Reader mode on Firefox for Android. Reader mode reformats web content for easy readability and operates as unprivileged content that is the equivalent of the formatted content. When Reader mode is unable to process content, it displays the original web pages. Since it is unprivileged, there are no restrictions on pages linking to or framing Reader mode content. The reported flaw is that privileged URLs can be passed to Reader mode and bypass the normal restrictions that prevent web pages from obtaining references to privileged contexts. If this issue was combined with another flaw that allowed for a violation of the same-origin policy, then the resulting combination could lead to arbitrary code execution.
**Firefox ESR**
- **Miscellaneous memory safety hazards (rv:37.0 / rv:31.6) –**
Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
- **Use-after-free when using the Fluendo MP3 GStreamer plugin**–**
This is due to a flaw in handling certain MP3 files by the plugin and its interaction with Mozilla code. This can lead to a potentially exploitable crash.
**Thunderbird**
- **Miscellaneous memory safety hazards (rv:37.0 / rv:31.6) –**
Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
- **Use-after-free when using the Fluendo MP3 GStreamer plugin**–**
This is due to a flaw in handling certain MP3 files by the plugin and its interaction with Mozilla code. This can lead to a potentially exploitable crash.
**3.0 Affected Products**
The detail lists of the Mozilla products updates are as below:
- Firefox
- Firefox ESR
- Thunderbird
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
**4.1 Mozilla Firefox**
Advisories:
<https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/>
Download:
<https://www.mozilla.org/en-GB/firefox/new/>
**4.2 Mozilla Firefox ESR**
Advisories:
<https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/>
Download:
<https://www.mozilla.org/en-US/firefox/organizations/all/>
**4.3 Mozilla Thunderbird**
Advisories:
<https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/>
Download:
<https://www.mozilla.org/en-US/thunderbird/>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#5a3923383f286363631a3923383f28293f392f28332e23743723) or [[email protected]](/cdn-cgi/l/email-protection#e5889c86809791a5889c86809791cb8a9782cb889c) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird,
<https://www.us-cert.gov/ncas/current-activity/2015/03/31/Mozilla-Releases-Security-Updates-Firefox-Firefox-ESR-and>
- Known Vulnerabilities in Mozilla Products,
<https://www.mozilla.org/en-US/security/known-vulnerabilities/>