The Cybersecurity and Infrastructure Agency (CISA) has ordered all federal civilian agencies to patch two critical Firefox vulnerabilities tracked as CVE-2022-26485 and CVE-2022-26486 by March 21. The bugs are rated critical as they can let attackers execute almost any command on systems running the vulnerable version of the browser. 

The two bugs are Use After Free flaws allowing attackers to trigger system crashes and execute malicious code on the target device, including downloading malware that could give them further access. Mozilla has reported that exploits are using the vulnerability potentially for remote code execution and getting out of the browser sandbox. 

Additionally, the CISA has added nine other vulnerabilities to its Known Exploited Vulnerabilities Catalogue based on evidence of being exploited by threat actors. Even though the order only applies to federal civilian agencies, the CISA has urged the public and private sector organisations to get their systems patched. 

In the News: Ransomware gang breaches 52 critical organisations; FBI issues warning

Hunting the bugs down

The vulnerabilities in Firefox were discovered and reported to Mozilla by a Chinese cybersecurity company called Qihoo 360 ATA. Following the disclosure, Mozilla released Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0 to fix both the bugs. 

As mentioned above, both vulnerabilities are Use After Free in nature. This happens when a program tries to access or use memory that has already been cleaned. Exploiting this vulnerability can cause programs to crash while allowing commands to be executed simultaneously without permission. The actual method of attack hasn’t been disclosed at the moment. 

A VMware vCenter server vulnerability needs to be fixed on the same deadline. A total of 11 vulnerabilities were added to the catalogue, including those mentioned above.

In the News: DirtyPipe gives root access to attackers on Linux distros; patch released