February 9, 2022
Mozilla has fixed the privilege escalation vulnerability in the Firefox 97 security update known as CVE-2022-22753.
Once the vulnerability is successfully exploited on unpatched systems, attackers can escalate their privileges to the highest level of privileges on a Windows system. Mozilla says the flaw “only affects Firefox on Windows. Other operating systems are unaffected.”
Other fixes that Firefox 97 fixes include several memory safety bugs found by Mozilla developers and the community in Firefox 96 and Firefox ESR 91.5.
Mozilla warned that systems running vulnerable versions of Firefox could be exploited to cause a heap-based buffer overflow.
Some likely consequences are program crashes, the execution of arbitrary code, and the bypass of security software once code execution is achieved.
Affected are all PDF viewers and email clients using NSS versions that have been approved for signature verification since October 2012.
Other updates to Firefox 97 include support for the new style of scrollbars on Windows 11. The new version removes support for direct generation of PostScript for printing on Linux. Printing to PostScript is still available as a supported option, however.
For more information, read the original story in BleepingComputer.
