Mozilla releases 10 patches, five critical, for Firefox

The issues also affect the Thunderbird email client and Seamonkey software suite

Mozilla released 10 patches for three versions of its Firefox browser on Tuesday, five of which are considered critical and could be used to remotely install malicious code.

The U.S. Computer Emergency Readiness Team warned that the problems "could allow a remote attacker to execute arbitrary code, bypass intended access restrictions, cause a denial-of-service condition or obtain sensitive information."

The Mozilla products affected are Firefox 25, Firefox ESR 24.1, Firefox Extended Support Release (ESR) 17.0.10, Thunderbird 24.1, Thunderbird ESR 17.0.10, and Seamonkey 2.22.

Among the flaws fixed were several memory safety bugs in the browser engine, which is also in Mozilla's Thunderbird email client and Seamonkey, a suite of applications and web development tools.

Those bugs, tagged as update MFSA 2013-93, "showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code," according to Mozilla's advisory.

The other four critical vulnerabilities could cause potentially exploitable crashes, Mozilla said.

One of the vulnerabilities given a "high" risk rating, MFSA 2013-99, could divulge information on a computer's local system. A security researcher, Cody Crews, discovered "a method to append an iframe into an embedded PDF object rendered with the chrome privileged PDF.js."

"This can used to bypass security restrictions to load local or chrome privileged files and objects within the embedded PDF object," Mozilla wrote.

In August, the TOR project warned that a vulnerability in Firefox ESR may have been used to collect information on computers visiting websites configured as TOR hidden services.

TOR, short for The Onion Router, is a system that allows for more anonymous browsing by routing encrypted requests for websites through servers worldwide. The TOR Project distributes a Browser Bundle, which includes Firefox for browsing with TOR.

The vulnerability could have facilitated the execution of remote code, but instead may have been used to collect the hostname and MAC address of Windows computers, it said. The TOR Project typically updates its browser bundle package quickly after Mozilla releases new patches.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the PC World newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags patchesapplicationssecuritybrowsersMozilla FoundationsoftwareExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?