# MA-783.042020: MyCERT Alert - Vulnerabilities in Mozilla Firefox & Firefox ESR

**Date:** 09 Apr 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-783.042020  
**Advisory ID:** MA-783.042020

---

**1.0 Introduction**
Recently, Mozilla has released Firefox version 74.0.1 and Firefox ESR 68.6.1 to address two (2) critical vulnerabilities. This vulnerability may cause the application to crash and likely to allow the attacker to take control of the affected system. Mozilla has already acknowledged the targeted attacks in the wild abusing this flaw and rated to be critical.
**2.0 Impact**
The first vulnerability identified in CVE-2020-6819 as a use-after-free bug which caused by race condition when running the nsDocShell destructor. On the other hand, second vulnerability in CVE-2020-6820 also identified as a use-after-free bug which caused by race condition when handling ReadableStream.
**3.0 Affected System and Devices**
- Firefox < 74.0.1
- Firefox ESR < 68.6.1
**4.0 Recommendations**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The current latest versions are as below:
- <https://www.mozilla.org/en-US/firefox/74.0.1/releasenotes/>
- <https://www.mozilla.org/en-US/firefox/68.6.1/releasenotes/>
Advisories can be referred at:
- <https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/>
- <https://www.bleepingcomputer.com/news/security/mozilla-patches-two-actively-exploited-firefox-zero-days/>