Mozilla To Patch Critical Firefox BugMozilla To Patch Critical Firefox Bug
Mozilla has confirmed a zero day vulnerability that affects Firefox version 3.6. The flaw makes it possible for malicious code to be injected into systems running the web browser. A fully tested fix won't be available until March 30.
March 20, 2010
Mozilla has confirmed a zero day vulnerability that affects Firefox version 3.6. The flaw makes it possible for malicious code to be injected into systems running the web browser. A fully tested fix won't be available until March 30.The "highly critical" flaw was first announced on February 18 and discovered by security researcher Evgeny Legerov. For a time, Mozilla had claimed that it couldn't reproduce the flaw and did not have enough information on the vulnerability from Legerov to do so. That apparently changed and the researcher sent Mozilla the information they needed to be able to craft a fix.
From Mozilla's security blog:
"Mozilla was contacted by Evgeny Legerov, the security researcher who discovered the bug referenced in the Secunia report, with sufficient details to reproduce and analyze the issue. The vulnerability was determined to be critical and could result in remote code execution by an attacker. The vulnerability has been patched by developers and we are currently undergoing quality assurance testing for the fix. Firefox 3.6.2 is scheduled to be released March 30th and will contain the fix for this issue. As always, we encourage users to apply this update as soon as it is available to ensure a safe browsing experience."
The flaw affects only Firefox 3.6 and other Mozilla software based on earlier versions of Firefox, such as Thunderbird and SeaMonkey, are not affected.
Users that don't want to wait until the end of the month can download the Firefox 3.6.2 Release Candidate here.
In other browser security news, Apple last week patched 16 vulnerabilities that affected Safari. According to Apple, the majority of the flaws affected Webkit.
You'll likely be hearing plenty of news about browser security this week, as the annual Pwn2Own 2010 contest is underway, with awards totaling $40,000 for those who win security challenges featuring Apple Safari 4, Google Chrome, Mozilla Firefox 3, and , Microsoft Internet Explorer (Version 8 on Windows 7, Version 7 on Vista and XP).
More information of that contest is available here.
Follow my security and technology observations throughout the day on Twitter.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023