Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-28
• EPSS: 69% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

CISA: Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 18 Apr 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.htmlMailing ListThird Party Advisory
• rhn.redhat.com/errata/RHSA-2013-0981.htmlThird Party Advisory
• rhn.redhat.com/errata/RHSA-2013-0982.htmlThird Party Advisory
• www.debian.org/security/2013/dsa-2716Mailing ListThird Party Advisory
• www.debian.org/security/2013/dsa-2720Mailing ListThird Party Advisory
• www.mozilla.org/security/announce/2013/mfsa2013-53.htmlVendor Advisory
• www.securityfocus.com/bid/60778Broken LinkThird Party AdvisoryVDB Entry
• www.ubuntu.com/usn/USN-1890-1Third Party Advisory
• www.ubuntu.com/usn/USN-1891-1Third Party Advisory
• bugzilla.mozilla.org/show_bug.cgiIssue Tracking
• bugzilla.mozilla.org/show_bug.cgiIssue Tracking
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996Broken Link
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource