Source: heimdalsecurity.com – Author: Livia Gyongyoși
On September 12th, 2023, Mozilla released crucial security updates to address a critical Firefox zero day vulnerability. Security researchers also detected the flaw in the Thunderbird application.
The zero-day was dubbed CVE-2023-4863 and has been actively exploited in the wild. Interestingly enough, the Common Vulnerabilities and Exposures (CVE) system website mentions Chrome as the assigner of CVE-2023-4863.
A day earlier, Google too released a patch for the same CVE-2023-4863 issue affecting its Chrome browser.
Details About the Zero Day Vulnerability
The zero day vulnerability is a heap buffer overflow flaw within the WebP image format. Threat actors can exploit it to execute arbitrary code when processing a specially crafted image.
In their security advisory, Mozilla stated that:
Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of this issue being exploited in other products in the wild.
The vulnerability affected Firefox 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird. Mozilla released patches for all the impacted products.
According to the National Vulnerability Database (NVD), the flaw can enable remote code execution. Thus, an attacker could run an out-of-bounds memory write through a crafted HTML page.
How to Stay Safe from CVE-2023-4863
Automated patch management helps System Administrators keep their assets safe from known vulnerabilities. Now that there is a patch available for CVE-2023-4863, the most important thing to do is apply updates immediately.
However, in this kind of situation, security teams face two challenges:
- identifying the vulnerability and prioritizing it correctly
- actually updating all the company`s endpoints.
In medium and large organizations, this is a time and resource consuming task. So, we recommend using an automated patch management solution rather than manual patching. Additionally, Heimdal®`s Infinity Management module monitors and patches in time any 3rd Party Application you might use. All your software will be up to date with just a click`s effort.
Request a free trial now and make sure your endpoints are safe from any known vulnerabilities.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, and Youtube, for more cybersecurity news and topics.
Automate the Patch Management Process with Heimdal®
30-day Free Trial. Offer valid only for companies.
Original Post URL: https://heimdalsecurity.com/blog/mozilla-zero-day-vulnerability/
Category & Tags: Cybersecurity News – Cybersecurity News
