"Firefox 118 Patches High-Severity Vulnerabilities"

Mozilla recently announced security updates for both Firefox and Thunderbird, addressing a total of nine vulnerabilities in its products, including high-severity flaws.  Firefox 118 was released to the stable channel with patches for all nine vulnerabilities, which are memory issues, and most could lead to exploitable crashes.  According to Mozilla, the first two high-severity flaws tracked as CVE-2023-5168 and CVE-2023-5169 are out-of-bounds write issues in the browser’s FilterNodeD2D1 and PathOps components.  Both could lead to “a potentially exploitable crash in a privileged process.”  Mozilla stated that the third bug, CVE-2023-5170, is a memory leak issue that “could be used to effect a sandbox escape if the correct data was leaked.  Mozilla noted that another high-severity vulnerability was patched in the Ion compiler.  Tracked as CVE-2023-5171 and described as a use-after-free condition, the bug allowed an attacker to write two NUL bytes, causing a potentially exploitable crash.  According to Mozilla, Firefox 118 also patches CVE-2023-5172, a memory corruption in Ion Hints that could lead to a use-after-free condition and a potentially exploitable crash.  The browser update also resolves multiple high-severity memory safety bugs that are collectively tracked as CVE-2023-5176.  According to Mozilla, “with enough effort,” an attacker could exploit some of these flaws to execute arbitrary code.  The three remaining issues patched with the release of Firefox 118 are medium and low-severity memory bugs.  Mozilla also recently announced the release of Firefox ESR 115.3 and Thunderbird 115.3, with patches for five vulnerabilities each.  These include four of the high-severity flaws and one medium-severity bug that Firefox 118 addresses.  Mozilla makes no mention of any of these vulnerabilities being exploited in malicious attacks.   

SecurityWeek reports: "Firefox 118 Patches High-Severity Vulnerabilities"