Afficher toutes les solutions
CVE-2019-17026 :
Mozilla releases patch to address Firefox flaw being used as part of targeted attacks.
Contexte
On January 8, Mozilla Foundation released a security advisory to address a critical zero-day flaw in Mozilla Firefox, which has been exploited in targeted attacks.
Analyse
CVE-2019-17026 is a type confusion vulnerability in IonMonkey, the JavaScript Just-In-Time (JIT) compiler for SpiderMonkey, Mozilla’s JavaScript engine. According to Mozilla’s advisory, the flaw exists in the JIT compiler due to “incorrect alias information for setting array elements,” specifically in StoreElementHole and FallibleStoreElement.
The vulnerability was reported to Mozilla by researchers at Qihoo 360 ATA. Mozilla’s advisory states they are “aware of targeted attacks in the wild abusing this flaw.” Based on this note in the advisory, it appears the vulnerability was exploited in the wild as a zero-day. Further information about the exploitation was not available at the time this blog post was published.
This advisory follows the release of Firefox 72 and Firefox Extended Support Release (ESR) 68.4 on January 7, which included the following security advisories:
- Firefox 72: Mozilla Foundation Security Advisory 2020-01
- Firefox ESR 68.4: Mozilla Foundation Security Advisory 2020-02
Last year, Mozilla patched CVE-2019-11707, another type confusion flaw that was used in conjunction with CVE-2019-11708, a sandbox escape vulnerability in targeted attacks.
Démonstration de faisabilité (PoC)
At this time, no proof of concept is available for this vulnerability.
Solution
To address CVE-2019-17026, Mozilla released Firefox 72.0.1 and Firefox ESR 68.4.1. Because this vulnerability has been exploited in targeted attacks, Firefox users are advised to upgrade as soon as possible.
Identification des systèmes affectés
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Où trouver plus d'informations
Rejoignez l'équipe SRT de Tenable sur Tenable Community.
Apprenez-en plus sur Tenable, la première plateforme de Cyber Exposure qui vous permet de gérer votre surface d'attaque moderne de manière globale.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Articles connexes
CVE-2023-40044, CVE-2023-42657: Progress Software Patches Multiple Vulnerabilities in WS_FTP Server
October 2, 2023Progress Software patches multiple flaws in its WS_FTP Server product, including a pair of critical flaws, one with a maximum CVSS rating of 10
Cybersecurity Snapshot: CISOs See Budgets Tighten, as Cyberthreats Intensify
September 29, 2023After double-digit growth in the past two years, cybersecurity budgets expanded more modestly in 2023. Plus, a survey offers an inside look at how organizations are grappling with cyber challenges. In addition, the U.S. and Japan warn about a China-linked group that’s stealthily compromising network devices. And much more!
CISA Adds Vulnerabilities Exploitable Via Bluetooth to KEV
September 28, 2023Recently, CISA added four vulnerabilities for Owl Labs Meeting Owl devices to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities are exploitable via Bluetooth Low Energy (BLE). This means an attacker would need to be physically near the device in order to exploit it.
How to Meet FY 2023 U.S. State and Local Cybersecurity Grant Program Objectives
October 4, 2023This is the first of a two-part series exploring how Tenable One can help state, local, tribal and territorial (SLTT) agencies meet the goals and objectives of the SLCGP. In 2021, the U.S. Infrastr...
New U.S. SLCGP Cybersecurity Plan Requirement: Adopt Cybersecurity Best Practices Using CISA's CPGs
October 4, 2023This is the second of a two-part series exploring how Tenable One can help state, local, tribal and territorial (SLTT) agencies meet the goals and objectives of the SLCGP.
CVE-2023-40044, CVE-2023-42657: Progress Software Patches Multiple Vulnerabilities in WS_FTP Server
October 2, 2023Progress Software patches multiple flaws in its WS_FTP Server product, including a pair of critical flaws, one with a maximum CVSS rating of 10
- Gestion des vulnérabilités