Mozilla Firefox was patched this week with 58 corrections that can be exploited by a remote attacker for arbitrary code execution.
Johann Hofmann, a Mozilla developer, discovered that arbitrary code execution is possible due to unsanitized output in the browser user interface. This vulnerability, tracked as CVE-2018-5124, affects Firefox versions 56 through 58 and it has been fixed with the release of Firefox 58.0.1. According to Mozilla, Firefox for Android and Firefox 52 ESR are not impacted. Linux distributions have also started pushing out updated packages that include the fix.
“The vulnerability is due to insufficient sanitization of HTML fragments in chrome-privileged documents by the affected software,” Cisco said in an advisory describing this flaw. “An attacker could exploit the vulnerability by persuading a user to access a link or file that submits malicious input to the affected software. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the user. If the user has elevated privileges, the attacker could compromise the system completely.”
Mozilla Firefox version 58 was released on January 23 and patches more than 30 vulnerabilities, including yet a potentially exploitable user-after-free bug and memory safety issues that have been rated as critical.
Notice that ten of these security holes were also addressed earlier this month in the Thunderbird email client with the release of version 52.6. Mozilla pointed out that the flaws typically cannot be exploited against Thunderbird using crafted emails.
Mozilla has a bug bounty program for Firefox. It has paid out nearly $1 million to experts who reported vulnerabilities. Novel exploit or form of exploitation can earn more than $10.000. The organization says it has paid out a total of roughly $3 million across its bug bounty programs.