# MA-504.082015: MyCERT Advisory - Mozilla Releases Security Updates for Firefox and Firefox ESR

**Date:** 07 Aug 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-504.082015  
**Advisory ID:** MA-504.082015

---

#### **1.0 Introduction** The Mozilla Foundation has released security updates to address a critical vulnerability in the built-in PDF Viewer for Firefox and Firefox ESR. Exploitation of the vulnerability may allow an attacker to read and steal sensitive local files on the victim's computer. This vulnerability is fixed in Firefox 39.0.3 and Firefox ESR 38.1.1.
**2.0 Impact**
The vulnerability impacting each software are listed below:
- **Same origin violation and local file stealing via PDF reader**
Security researcher Cody Crews reported on a way to violate the same origin policy and inject script into a non-privileged part of the built-in PDF Viewer. This would allow an attacker to read and steal sensitive local files on the victim's computer. Mozilla has received reports that an exploit based on this vulnerability has been found in the wild.
**3.0 Affected Products**
- Firefox
- Firefox ESR
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
**4.1 Mozilla Firefox**
Advisories:
<https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/>
Download:
<https://www.mozilla.org/en-GB/firefox/new/>
**4.2 Mozilla Firefox ESR**
Advisories:
<https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/>
Download:
<https://www.mozilla.org/en-US/firefox/organizations/all/>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#ee8d978c8b9cd7d7d7ae8d978c8b9c9d8b8d9b9c879a97c08397) or [[email protected]](/cdn-cgi/l/email-protection#a5c8dcc6c0d7d1e5c8dcc6c0d7d18bcad7c28bc8dc) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- Mozilla Releases Security Updates for Firefox and Firefox ESR, <https://www.us-cert.gov/ncas/current-activity/2015/08/06/Mozilla-Releases-Security-Updates-Firefox-and-Firefox-ESR>
- Mozilla Foundation Security Advisory 2015-78, <https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/>
- <https://www.mozilla.org/en-US/security/known-vulnerabilities/>