Mozilla discloses more Firefox flaws

Information on some unpatched vulnerabilities now available to the public

Mozilla patched more than one vulnerability in Firefox when it updated the browser to version 3.6.2 on Monday, the company confirmed today.

A total of 10 flaws were fixed in Firefox 3.6.2, according to Mozilla's security advisory page , but details of at least three that also affect the older Firefox 3.0 and Firefox 3.5 browsers have been released before the company has patched those versions. Mozilla is scheduled to ship the updates, Firefox 3.0.19 and Firefox 3.5.9, next Monday, March 30.

Mozilla accelerated the release of Firefox 3.6.2 because a Russian researcher had announced a critical vulnerability in how the browser decodes the Web Open Font Format (WOFF), a Web-based font standard. Only Firefox 3.6 supports WOFF.

However, four of the vulnerabilities already patched in Firefox 3.6.2 also apply to older editions of the browser. One of the 10 fixed flaws that Mozilla ranked as "low" in its four step scoring system, one tagged as "high" and two marked as "critical," also affect the unpatched Firefox 3.0 and 3.5.

Technical details of three of the four vulnerabilities -- the one rated low and the two ranked critical -- are available on Mozilla's Bugzilla change- and bug-tracking database. Information on the bug rated high has been blocked, however, and cannot be viewed by the public.

"Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code," Mozilla stated in the advisory accompanying the two critical bugs that also affect older, as-yet unpatched, versions of Firefox.

Typically, software makers omit information, or restrict access to that information, until patches have been released, knowing that attackers might be able to use the details to craft exploits that would put users at risk.

Information on some vulnerabilities will not be published until next week, Mozilla said.

Mozilla has rushed out fixes before, although -- like rival browser maker Microsoft -- it does so rarely. Last March, for example, Mozilla updated Firefox 3.0 to patch a pair of vulnerabilities, including one that had been used the week before by a German college student to hack the browser and take home $5,000 for his efforts at the Pwn2Own contest.

The bug quashed Monday -- and for a day, the only one for which information was published -- was disclosed by Russian researcher Evgeny Legerov in February. Initially, Legerov refused to provide proof of his exploit claims to Mozilla, prompting some to question his motives or wonder whether it was a hoax. According to Mozilla's Bugzilla change- and bug-tracking database, Legerov finally verified the vulnerability with the company's developers on March 13.

Mozilla has been under pressure to provide a patch. Last Friday, for instance, the German government's computer security agency urged users to abandon Firefox until a fix is available. Buerger-CERT, part of the Federal Office for Security in Information Technology, which is known by its German initials of BSI, retracted that recommendation yesterday, after Mozilla released Firefox 3.6.2.

Later today, Firefox -- as well as Microsoft's Internet Explorer, Google 's Chrome and Apple 's Safari -- will face several notable hackers at Pwn2Own, a contest that pits researchers against four notebooks running the browsers. Among those eager to go for the $5,000 cash prizes are two former winners, including a German college student who successfully exploited Firefox last year.

Next week's Firefox 3.0.19 will be the last security update for the 2008 browser, Mozilla has announced previously. Users running that edition have been urged to update to Firefox 3.6.

In other news from Mozilla, the company will probably ship "Lorentz" with the next iteration of its standard Firefox security releases, Firefox 3.5.10 and Firefox 3.6.3. Lorentz is the codename for an in-place upgrade that will add several features to the browser. The most notable change will be to separate external plug-ins, such as Adobe's Flash, from Firefox's other processes so that if the plug-in crashes, the browser won't follow suit.

Mozilla has not set a release timetable for the release of Firefox 3.5.10 and Firefox 3.6.3.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securitymozilla firefox

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?