Firefox 97 also adds new features, improvements "Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code," Mozilla added.
Mozilla also said that Firefox 97 addresses multiple memory safety bugs found by Mozilla developers and community in Firefox 96 and Firefox ESR 91.5. "This bug only affects Firefox on Windows.
This could have been used to escalate to SYSTEM access," Mozilla explained. "A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. Successful exploitation on unpatched systems can let attackers escalate their privileges to NT AUTHORITY\SYSTEM account rights (the highest level of privileges on a Windows system). Mozilla fixed the privilege escalation security flaw tracked as CVE-2022-22753 today, with the release of Firefox 97. This provides Firefox users with a seamless updates experience where they are no longer required to click 'Yes' in the Windows User Account Control (UAC) dialog before updating their web browser or email client. The Mozilla Maintenance Service is an optional Firefox and Thunderbird service that makes application updates possible in the background. Mozilla released a security update to address a high severity privilege escalation vulnerability found in the Mozilla Maintenance Service.
0 kommentar(er)
