ALERT: Update Firefox to fix critical vulnerability
Wednesday, June 19, 2019
The information below was sent to U-M staff groups via email on June 19, 2019. It was intended for U-M IT staff who are responsible for university computers that run the Mozilla Firefox web browser.
A critical vulnerability in the Mozilla Firefox web browser could allow attackers to remotely execute arbitrary code. This vulnerability is being actively exploited in the wild. Update to the newest version of Firefox as soon as possible for protection against this vulnerability.
Attackers could exploit the flaw to take control of affected systems. An attacker would need to cause unpatched Firefox versions to first load maliciously crafted web content, and subsequently execute arbitrary code on their systems.
- Versions of Firefox prior to 67.0.3. This is the version of Firefox intended for individuals who manage their own personal computers.
- Versions of Firefox Extended Support Release (ESR) prior to 60.7.1. Mozilla Firefox ESR is meant for organizations that manage their client desktops. For example, MiWorkspace users will have Firefox ESR on their computers.
If you are responsible for managing university computers running Firefox, update Firefox to the newest version to fix the vulnerability. See Information for Users below for details about updating your own computer(s).
Mozilla is aware of targeted attacks in the wild exploiting the vulnerability.
How We Protect U-M
- Information Assurance (IA) monitors a number of sources for information about new vulnerabilities and threats and provides up-to-date information to the university community.
- IA performs regular vulnerability scans of university networks to identify vulnerable devices and request remediation.
- IA provides vulnerability management guidance to the university.
Information for Users
Use the latest version of Firefox:
- University-managed machines. MiWorkspace staff plan to update MiWorkspace machines this week, after appropriate testing. Staff who manage other university machines are expected to apply the update as appropriate for their environments.
- Personal machines. Firefox is set to update automatically (unless you have changed this setting yourself). You can update manually if you wish. See Update Firefox to the latest release.
In general, the best protection for your devices is this: keep your software and apps up-to-date, do not click suspicious links in email, do not open shared documents or email attachments unless you are expecting them and trust the person who sent them, and only use secure, trusted networks. For more information, see Phishing & Suspicious Email, Secure Your Devices, and Secure Your Internet Connection on the U-M Safe Computing website.
Questions, Concerns, Reports
Please contact firstname.lastname@example.org.
- Security vulnerabilities fixed in Firefox 67.0.3 and Firefox ESR 60.7.1 (Mozilla Foundation, 6/18/19)
- Mozilla patches Firefox zero-day abused in the wild (ZDNet, 6/18/19)
- Mozilla Firefox 67.0.3 Patches Actively Exploited Zero-Day (Bleeping Computer, 6/18/19)
- Update your Firefox browser now, there’s an emergency patch you’ll want (The Verge, 6/18/19)