Risk
7/26/2010
09:57 AM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Mozilla Patches Critical Firefox Security Patch

Just a few days after issuing more than a dozen security updates, many of them critical, the foundation that published the popular Firefox web browser issues a patch to fix its patch.

Just a few days after issuing more than a dozen security updates, many of them critical, the foundation that published the popular Firefox web browser issues a patch to fix its patch.According to Mozilla Foundation Security Advisory 2010-48, Mozilla developer Daniel Holbert identified that the fix to the plugin parameter array crash that was fixed in Firefox 3.6.7 caused a crash that showed indications of memory corruption. "In certain circumstances, properties in the plugin instance's parameter array could be freed prematurely leaving a dangling pointer that the plugin could execute, potentially calling into attacker-controlled memory," the security update states.

The update came several days after Mozilla Foundation issued 14 advisories with eight listed as "critical," two as "high," and four as "moderate." Critical vulnerabilities are especially troublesome as Mozilla defines them as a vulnerability that: can be used to run attacker code and install software, requiring no user interaction beyond normal browsing.

Other than avoiding untrustworthy web sites, being careful of what files are downloaded to the system, and not running software of unknown origin, keeping one's web browser up to date is an important part of keeping a system secure.

Firefox users can see if they're running the latest, and presumably the safest, version of Firefox by selecting "Check for updates" within the Help pull-down.

For my security, technology, and business observations throughout the day, fine me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9728
Published: 2015-08-31
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c.

CVE-2014-9729
Published: 2015-08-31
The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.

CVE-2014-9730
Published: 2015-08-31
The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.

CVE-2014-9731
Published: 2015-08-31
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and...

CVE-2015-1333
Published: 2015-08-31
Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.