Mozilla has released updates to address zero-days in several products , which were exploited during the Pwn2Own Vancouver 2022.
See also: Mozilla adds AV1 support to Firefox
The two critical flaws could allow JavaScript on mobile and desktop computers running vulnerable versions of Firefox, Firefox ESR, Firefox for Android, and Thunderbird.
The zero-days have been fixed in Firefox 100.0.2, Firefox ESR 91.9.1, Firefox for Android 100.3 , and Thunderbird 91.9.1.
Manfred Paul (@_manfp) won $100,000 and 10 Master of Pwn points and improper input validation errors on the first day of Pwn2Own
The first vulnerability , tracked as CVE-2022-1802, could let an attacker corrupt the methods of an Array object in JavaScript, using prototype pollution to achieve privileged JavaScript code execution.
See also: Mozilla removes default Russian search providers in Firefox
The second, CVE-2022-1529, allows attackers to abuse Java object indexing with improper input validation in attacks .
The Cybersecurity and Infrastructure Security Agency (CISA) also encouraged administrators and users to patch these security flaws, as threat actors could exploit them to "take control of an affected system."
Mozilla patched these vulnerabilities two days after they were exploited and reported in the Pwn2Own hacking contest by Manfred Paul.
However, vendors are typically in no rush to release patches after Pwn2Own, as they have 90 days to push security fixes until Trend Micro's Zero Day Initiative publicly discloses them.
See also: Mozilla partners with Disney to bring promotional wallpapers to Firefox 98 on Android
Pwn2Own 2022 Vancouver ended on May 20 after 17 competitors won $1,155,000 for zero-day exploits and exploit presented over a three-day period after 21 attempts.
Security researchers also won $400,000 for 26 zero-day exploits targeting ICS and SCADA products that were presented between April 19 and 21 during the Pwn2Own Miami 2022 competition.
