# MA-565.012016: MyCERT Advisory - Mozilla Releases Security Updates

**Date:** 28 Jan 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-565.012016  
**Advisory ID:** MA-565.012016

---

####
**1.0 Introduction**
Mozilla has released security updates to address multiple vulnerabilities in Firefox. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system.
**2.0 Impact**
Some of the critical vulnerabilities impacting the softwares are listed below:
**Firefox**
- **Unsafe memory manipulation found through code inspection**
Security researcher Ronald Crane reported three vulnerabilities affecting released code that was found through code inspection. These include a high rated memory safety issue in the ANGLE graphics library, a moderate rated potential wild pointer flaw when handling zip files, and a critical rated integer overflow during metadata parsing in Mozilla’s use of the libstagefright library.
- **Buffer overflow in WebGL after out of memory allocation**
Security researcher Aki Helin used the Address Sanitizer tool to find a buffer overflow write when rendering some WebGL content. This leads to a potentially exploitable crash.
**Firefox ESR**
- **Miscellaneous memory safety hazards (rv:44.0/rv:38.6)**
Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
**3.0 Affected Products**
- Firefox
- Firefox ESR
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
> **4.1 Mozilla Firefox**
>
> Advisories:
> <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/>
> Download:
> <https://www.mozilla.org/en-GB/firefox/new/>
>
> **4.2 Mozilla Firefox ESR**
>
> Advisories:
> <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/>
> Download:
> <https://www.mozilla.org/en-US/firefox/organizations/all/>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#bddec4dfd8cf848484fddec4dfd8cfced8dec8cfd4c9c493d0c4) or [[email protected]](/cdn-cgi/l/email-protection#c2afbba1a7b0b682afbba1a7b0b6ecadb0a5ecafbb) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.us-cert.gov/ncas/current-activity/2016/01/26/Mozilla-Releases-Security-Updates>
- <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44/>
- <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#firefoxesr38.6>