# MA-573.022016: MyCERT Advisory - Mozilla Releases Security Updates

**Date:** 15 Feb 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-573.022016  
**Advisory ID:** MA-573.022016

---

####
**1.0 Introduction**
Mozilla has released security updates to address multiple vulnerabilities in Firefox and Firefox ESR. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system.
**2.0 Impact**
Some of the critical vulnerabilities impacting the softwares are listed below:
> **Firefox**
>
> - **Same-origin-policy violation using Service Workers with plugins**
>   **Jason Pang** of OneSignal reported that service workers intercept responses to plugin network requests made through the browser. Plugins which make security decisions based on the content of network requests can have these decisions subverted if a service worker forges responses to those requests. For example, a forged crossdomain.xml could allow a malicious site to violate the same-origin policy using the Flash plugin.
>
>
>
> **Firefox ESR**
>
> - **Vulnerabilities in Graphite 2**
>   Security researcher Holger Fuhrmannek reported that a malicious Graphite "smart font" could circumvent the validation of internal instruction parameters in the Graphite 2 library using special CNTXT\_ITEM instructions. This could result in arbitrary code execution. This issue affected Graphite 2 version 1.2.4, which was used in the Firefox ESR branch. To address this issue and other security vulnerabilities recently disclosed by Cisco Talos affecting this version of the library, Firefox ESR has been updated to version 1.3.5, the same one used in Firefox 44.
**3.0 Affected Products**
- Firefox 44.0.0 and below
- Firefox ESR 38.6 and below
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
> **4.1 Mozilla Firefox**
> Advisories:
> <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/>
> Download:
> <https://www.mozilla.org/en-GB/firefox/new/>
>
> **4.2 Mozilla Firefox ESR**
> Advisories:
> <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/>
> Download:
> <https://www.mozilla.org/en-US/firefox/organizations/all/>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#ee8d978c8b9cd7d7d7ae8d978c8b9c9d8b8d9b9c879a97c08397) or [[email protected]](/cdn-cgi/l/email-protection#f69b8f95938482b69b8f95938482d8998491d89b8f) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442 
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.us-cert.gov/ncas/current-activity/2016/02/11/Mozilla-Releases-Security-Updates>
- <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44.0.2>
- <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#firefoxesr38.6.1>