Lucene search

Kaspersky LabKLA20169

HistoryJan 17, 2023 - 12:00 a.m.

KLA20169 Multiple vulnerabilities in Mozilla Firefox ESR

2023-01-1700:00:00

Kaspersky Lab

threats.kaspersky.com

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.2%

JSON

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to spoof user interface, bypass security restrictions, execute arbitrary code.

Below is a complete list of vulnerabilities:

Security UI vulnerability in Fullscreen notification can be exploited to spoof user interface.
Security bypass vulnerability in libusrsctp can be exploited to bypass security restrictions.
Security vulnerability in WebWorker can be exploited to bypass security restrictions.
Code execution vulnerability in GTK drag and drop can be exploited remotely to execute arbitrary code.
Code execution vulnerability in Devtools can be exploited remotely to execute arbitrary code.
Memory safety vulnerability can be exploited to execute arbitrary code.
Security vulnerability in format directive can be exploited to bypass security restrictions.
Security UI vulnerability in cross-origin iframe can be exploited to spoof user interface.

Original advisories

MFSA2023-02

Related products

Mozilla-Firefox-ESR

CVE list

CVE-2022-46877 warning

CVE-2022-46871 critical

CVE-2023-23602 high

CVE-2023-23598 high

CVE-2023-23599 high

CVE-2023-23605 critical

CVE-2023-23603 high

CVE-2023-23601 high

Solution

Update to the latest version

Download Firefox ESR

Impacts

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.