Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/20/2010
06:35 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Mozilla To Patch Critical Firefox Bug

Mozilla has confirmed a zero day vulnerability that affects Firefox version 3.6. The flaw makes it possible for malicious code to be injected into systems running the web browser. A fully tested fix won't be available until March 30.

Mozilla has confirmed a zero day vulnerability that affects Firefox version 3.6. The flaw makes it possible for malicious code to be injected into systems running the web browser. A fully tested fix won't be available until March 30.The "highly critical" flaw was first announced on February 18 and discovered by security researcher Evgeny Legerov. For a time, Mozilla had claimed that it couldn't reproduce the flaw and did not have enough information on the vulnerability from Legerov to do so. That apparently changed and the researcher sent Mozilla the information they needed to be able to craft a fix.

From Mozilla's security blog:

Mozilla was contacted by Evgeny Legerov, the security researcher who discovered the bug referenced in the Secunia report, with sufficient details to reproduce and analyze the issue. The vulnerability was determined to be critical and could result in remote code execution by an attacker. The vulnerability has been patched by developers and we are currently undergoing quality assurance testing for the fix. Firefox 3.6.2 is scheduled to be released March 30th and will contain the fix for this issue. As always, we encourage users to apply this update as soon as it is available to ensure a safe browsing experience.

The flaw affects only Firefox 3.6 and other Mozilla software based on earlier versions of Firefox, such as Thunderbird and SeaMonkey, are not affected.

Users that don't want to wait until the end of the month can download the Firefox 3.6.2 Release Candidate here.

In other browser security news, Apple last week patched 16 vulnerabilities that affected Safari. According to Apple, the majority of the flaws affected Webkit.

You'll likely be hearing plenty of news about browser security this week, as the annual Pwn2Own 2010 contest is underway, with awards totaling $40,000 for those who win security challenges featuring Apple Safari 4, Google Chrome, Mozilla Firefox 3, and , Microsoft Internet Explorer (Version 8 on Windows 7, Version 7 on Vista and XP).

More information of that contest is available here.

Follow my security and technology observations throughout the day on Twitter.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7029
PUBLISHED: 2020-08-11
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged ...
CVE-2020-17489
PUBLISHED: 2020-08-11
An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible f...
CVE-2020-17495
PUBLISHED: 2020-08-11
django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
CVE-2020-0260
PUBLISHED: 2020-08-11
There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152225183
CVE-2020-16170
PUBLISHED: 2020-08-11
The Temi application 1.3.3 through 1.3.7931 for Android has hard-coded credentials.