The Cybersecurity and Infrastructure Security Agency (CISA) added two critical security vulnerabilities in Mozilla firefox, tracked as CVE-2022-26485 and CVE-2022-26486, to its Known Exploited Vulnerabilities Catalog. The US agency has ordered federal civilian agencies to address both issues by March 21, 2022.
Yesterday Mozilla has released Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0 to address the two zero-day vulnerabilities that are actively exploited in attacks.
The two vulnerabilities are “Use-after-free” issues in XSLT parameter processing and in the WebGPU IPC Framework respectively.
Successful exploitation of the flaws can cause a program crash or execute arbitrary commands on the machine.
Below is the description of both flaws included in the advisory published by Mozilla:
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Known Exploited Vulnerabilities Catalog and address the vulnerabilities in their infrastructure.
CISA added nine other vulnerabilities to its Known Exploited Vulnerabilities Catalog that are reported in the following table along with the associated due date.
|CVE ID||Vulnerability Name||Due Date|
|CVE-2022-26486||Mozilla Firefox Use-After-Free Vulnerability||03/21/22|
|CVE-2022-26485||Mozilla Firefox Use-After-Free Vulnerability||03/21/22|
|CVE-2021-21973||VMware vCenter Server, Cloud Foundation Server Side Request Forgery (SSRF)||03/21/22|
|CVE-2020-8218||Pulse Connect Secure Code Injection Vulnerability||09/07/22|
|CVE-2019-11581||Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability||09/07/22|
|CVE-2017-6077||NETGEAR DGN2200 Remote Code Execution Vulnerability||09/07/22|
|CVE-2016-6277||NETGEAR Multiple Routers Remote Code Execution Vulnerability||09/07/22|
|CVE-2013-0631||Adobe ColdFusion Information Disclosure Vulnerability||09/07/22|
|CVE-2013-0629||Adobe ColdFusion Directory Traversal Vulnerability||09/07/22|
|CVE-2013-0625||Adobe ColdFusion Authentication Bypass Vulnerability||09/07/22|
|CVE-2009-3960||Adobe BlazeDS Information Disclosure Vulnerability||09/07/22|
(SecurityAffairs – hacking, SIM swapping)