TTCSIRT-031.080917: TT-CSIRT Advisory – Mozilla Security Updates

Mozilla has released security updates to address multiple vulnerabilities in Firefox and Firefox ESR:

a) Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code.

b) A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished. This results in an exploitable crash.

c) A use-after-free vulnerability can occur while re-computing layout for a marquee element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash.

d) A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This results in a potentially exploitable crash.

e) A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed. This results in a potentially exploitable crash.