The Center for Internet Security is urging Firefox and Firefox ESR users to update immediately after researchers found vulnerabilities severe enough to allow attackers to run their own code on affected devices.
Mozilla has released updates to fix a large number of security problems in its Firefox web browser and in Firefox ESR, a version built for use in large organizations, according to the Center for Internet Security. Some of these flaws are serious enough that an attacker could use them to run malicious code, meaning software an attacker sneaks onto your device without your permission, on an affected computer.
The fixes apply to Firefox versions before 160, Firefox ESR versions before 153.7, and Firefox ESR versions before 115.45. If exploited, the most severe of these flaws could let an attacker install programs, view or change files, or even create new user accounts with full access to the system, the Center for Internet Security said.
How much damage an attacker could do depends partly on the account being used. People browsing with an account that doesn’t have administrator, or full control, permissions would likely see less impact than someone using an admin account, according to the advisory.
The Center for Internet Security rates the risk as high for large and medium-sized government agencies and businesses, medium for small organizations, and low for home users. There are currently no reports of these vulnerabilities being used in real-world attacks, the advisory states.
The Center for Internet Security recommends applying Mozilla’s updates to vulnerable systems right away, after appropriate testing. It also advises running everyday browsing from an account without administrator privileges, since that limits what an attacker could do if a flaw were exploited.
What you can do: Update Firefox or Firefox ESR to the latest version as soon as possible, and avoid browsing the web from an account with administrator access if you can help it.
Based on a release from Center for Internet Security.