Mozilla discloses more Firefox flaws

Information on some unpatched vulnerabilities now available to the public

Mozilla patched more than one vulnerability in Firefox when it updated the browser to version 3.6.2 on Monday, the company confirmed today.

A total of 10 flaws were fixed in Firefox 3.6.2, according to Mozilla's security advisory page , but details of at least three that also affect the older Firefox 3.0 and Firefox 3.5 browsers have been released before the company has patched those versions. Mozilla is scheduled to ship the updates, Firefox 3.0.19 and Firefox 3.5.9, next Monday, March 30.

Mozilla accelerated the release of Firefox 3.6.2 because a Russian researcher had announced a critical vulnerability in how the browser decodes the Web Open Font Format (WOFF), a Web-based font standard. Only Firefox 3.6 supports WOFF.

However, four of the vulnerabilities already patched in Firefox 3.6.2 also apply to older editions of the browser. One of the 10 fixed flaws that Mozilla ranked as "low" in its four step scoring system, one tagged as "high" and two marked as "critical," also affect the unpatched Firefox 3.0 and 3.5.

Technical details of three of the four vulnerabilities -- the one rated low and the two ranked critical -- are available on Mozilla's Bugzilla change- and bug-tracking database. Information on the bug rated high has been blocked, however, and cannot be viewed by the public.

"Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code," Mozilla stated in the advisory accompanying the two critical bugs that also affect older, as-yet unpatched, versions of Firefox.

Typically, software makers omit information, or restrict access to that information, until patches have been released, knowing that attackers might be able to use the details to craft exploits that would put users at risk.

Information on some vulnerabilities will not be published until next week, Mozilla said.

Mozilla has rushed out fixes before, although -- like rival browser maker Microsoft -- it does so rarely. Last March, for example, Mozilla updated Firefox 3.0 to patch a pair of vulnerabilities, including one that had been used the week before by a German college student to hack the browser and take home $5,000 for his efforts at the Pwn2Own contest.

The bug quashed Monday -- and for a day, the only one for which information was published -- was disclosed by Russian researcher Evgeny Legerov in February. Initially, Legerov refused to provide proof of his exploit claims to Mozilla, prompting some to question his motives or wonder whether it was a hoax. According to Mozilla's Bugzilla change- and bug-tracking database, Legerov finally verified the vulnerability with the company's developers on March 13.

Mozilla has been under pressure to provide a patch. Last Friday, for instance, the German government's computer security agency urged users to abandon Firefox until a fix is available. Buerger-CERT, part of the Federal Office for Security in Information Technology, which is known by its German initials of BSI, retracted that recommendation yesterday, after Mozilla released Firefox 3.6.2.

Later today, Firefox -- as well as Microsoft's Internet Explorer, Google 's Chrome and Apple 's Safari -- will face several notable hackers at Pwn2Own, a contest that pits researchers against four notebooks running the browsers. Among those eager to go for the $5,000 cash prizes are two former winners, including a German college student who successfully exploited Firefox last year.

Next week's Firefox 3.0.19 will be the last security update for the 2008 browser, Mozilla has announced previously. Users running that edition have been urged to update to Firefox 3.6.

In other news from Mozilla, the company will probably ship "Lorentz" with the next iteration of its standard Firefox security releases, Firefox 3.5.10 and Firefox 3.6.3. Lorentz is the codename for an in-place upgrade that will add several features to the browser. The most notable change will be to separate external plug-ins, such as Adobe's Flash, from Firefox's other processes so that if the plug-in crashes, the browser won't follow suit.

Mozilla has not set a release timetable for the release of Firefox 3.5.10 and Firefox 3.6.3.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securitymozilla firefox

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?