# MA-596.042016: MyCERT Advisory - Mozilla Releases Security Updates

**Date:** 28 Apr 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-596.042016  
**Advisory ID:** MA-596.042016

---

####
**1.0 Introduction**
Mozilla has released security updates to address multiple vulnerabilities in Firefox and Firefox ESR. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system.
**2.0 Impact**
Some of the critical vulnerabilities impacting the softwares are listed below:
**Firefox**
- **Firefox Health Reports could accept events from untrusted domains**
Mozilla engineer discovered that the Firefox Health Report (about:healthreport) accepts certain events from any content document present in the remote-report iframe. If there were another vulnerability that allowed the injection of web content into the Firefox Health Report iframe, this content could change the sharing preferences of a user by firing the appropriate events at it s containing page.
- **Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8)**
Mozilla developers fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
**Firefox ESR**
- **Write to invalid HashMap entry through JavaScript.watch()**
The **CESG**, the Information Security Arm of GCHQ, reported that the JavaScript .watch() method could be used to overflow the 32-bit generation count of the underlying HashMap, resulting in a write to an invalid entry. Under the right conditions this write could lead to arbitrary code execution. The overflow takes considerable time and a malicious page would require a user to keep it open for the duration of the attack.
**3.0 Affected Products**
- Firefox 45 and below
- Firefox ESR 38.7 and below
- FireFox ESR 45.0 and below
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
> **4.1 Mozilla Firefox**
>
> Advisories:
> <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/>
> Download:
> <https://www.mozilla.org/en-GB/firefox/new/>
>
> **4.2 Mozilla Firefox ESR**
>
> Advisories:
> <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/>
> Download:
> <https://www.mozilla.org/en-US/firefox/organizations/all/>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#bfdcc6dddacd868686ffdcc6dddacdccdadccacdd6cbc691d2c6) or [[email protected]](/cdn-cgi/l/email-protection#9af7e3f9ffe8eedaf7e3f9ffe8eeb4f5e8fdb4f7e3) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442 
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.us-cert.gov/ncas/current-activity/2016/04/26/Mozilla-Releases-Security-Updates>
- <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox46>
- <https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#firefoxesr45.1>