# MA-762.012020: MyCERT Advisory - Vulnerabilities in Mozilla Firefox & Firefox ESR

**Date:** 16 Jan 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-762.012020  
**Advisory ID:** MA-762.012020

---

**1.0 Introduction**
Recently, MyCERT received information from valid resources about exploits in Mozilla Firefox browser. This vulnerability may cause the application to crash and likely to allow attacker to take control of the affected system. Mozilla has already acknowledged the targeted attacks in the wild abusing this flaw and rated to be critical.
**2.0 Impact**
The vulnerability was identified as a type of confusion bug in IonMonkey JavaSecirpt JIT (Just-inTime) compiler of SpiderMonkey which known as Firefox JavaScript engine. Depending on its privilege, this vulnerability may allow arbitrary execution and will allow attacker to install programs that could view, change, clear data or create new accounts with full user rights.
**3.0 Affected Products**
- Firefox < 72.0.1
- Firefox ESR < 68.4.1
**4.0 Recommendations**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The current latest versions are as below:
- <https://www.mozilla.org/en-US/firefox/68.4.1/releasenotes/>
Advisories can be referred at:
- <https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-17026>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-17026>
- <https://www.computerworld.com/article/3513362/mozilla-patches-firefox-zero-day-as-attackers-exploit-flaw.html>