Mozilla discloses more Firefox flaws

Information on some unpatched vulnerabilities now available to the public

Mozilla patched more than one vulnerability in Firefox when it updated the browser to version 3.6.2 on Monday, the company confirmed today.

A total of 10 flaws were fixed in Firefox 3.6.2, according to Mozilla's security advisory page , but details of at least three that also affect the older Firefox 3.0 and Firefox 3.5 browsers have been released before the company has patched those versions. Mozilla is scheduled to ship the updates, Firefox 3.0.19 and Firefox 3.5.9, next Monday, March 30.

Mozilla accelerated the release of Firefox 3.6.2 because a Russian researcher had announced a critical vulnerability in how the browser decodes the Web Open Font Format (WOFF), a Web-based font standard. Only Firefox 3.6 supports WOFF.

However, four of the vulnerabilities already patched in Firefox 3.6.2 also apply to older editions of the browser. One of the 10 fixed flaws that Mozilla ranked as "low" in its four step scoring system, one tagged as "high" and two marked as "critical," also affect the unpatched Firefox 3.0 and 3.5.

Technical details of three of the four vulnerabilities -- the one rated low and the two ranked critical -- are available on Mozilla's Bugzilla change- and bug-tracking database. Information on the bug rated high has been blocked, however, and cannot be viewed by the public.

"Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code," Mozilla stated in the advisory accompanying the two critical bugs that also affect older, as-yet unpatched, versions of Firefox.

Typically, software makers omit information, or restrict access to that information, until patches have been released, knowing that attackers might be able to use the details to craft exploits that would put users at risk.

Information on some vulnerabilities will not be published until next week, Mozilla said.

Mozilla has rushed out fixes before, although -- like rival browser maker Microsoft -- it does so rarely. Last March, for example, Mozilla updated Firefox 3.0 to patch a pair of vulnerabilities, including one that had been used the week before by a German college student to hack the browser and take home $5,000 for his efforts at the Pwn2Own contest.

The bug quashed Monday -- and for a day, the only one for which information was published -- was disclosed by Russian researcher Evgeny Legerov in February. Initially, Legerov refused to provide proof of his exploit claims to Mozilla, prompting some to question his motives or wonder whether it was a hoax. According to Mozilla's Bugzilla change- and bug-tracking database, Legerov finally verified the vulnerability with the company's developers on March 13.

Mozilla has been under pressure to provide a patch. Last Friday, for instance, the German government's computer security agency urged users to abandon Firefox until a fix is available. Buerger-CERT, part of the Federal Office for Security in Information Technology, which is known by its German initials of BSI, retracted that recommendation yesterday, after Mozilla released Firefox 3.6.2.

Later today, Firefox -- as well as Microsoft's Internet Explorer, Google 's Chrome and Apple 's Safari -- will face several notable hackers at Pwn2Own, a contest that pits researchers against four notebooks running the browsers. Among those eager to go for the $5,000 cash prizes are two former winners, including a German college student who successfully exploited Firefox last year.

Next week's Firefox 3.0.19 will be the last security update for the 2008 browser, Mozilla has announced previously. Users running that edition have been urged to update to Firefox 3.6.

In other news from Mozilla, the company will probably ship "Lorentz" with the next iteration of its standard Firefox security releases, Firefox 3.5.10 and Firefox 3.6.3. Lorentz is the codename for an in-place upgrade that will add several features to the browser. The most notable change will be to separate external plug-ins, such as Adobe's Flash, from Firefox's other processes so that if the plug-in crashes, the browser won't follow suit.

Mozilla has not set a release timetable for the release of Firefox 3.5.10 and Firefox 3.6.3.

Join the newsletter!

Or
Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securitymozilla firefox

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Essentials

James Cook University - Master of Data Science Online Course

Learn more >

Mobile

Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >

Exec

Budget

Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?