21 Firefox vulnerabilities reported today


Recommended Posts

http://secunia.com/advisories/19631/

Description:

Multiple vulnerabilities have been reported in Firefox, which can be exploited by malicious people to conduct cross-site scripting and phishing attacks, bypass certain security restrictions, disclose sensitive information, and potentially compromise a user's system.

1) An error exists where JavaScript can be injected into another page, which is currently loading. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

2) An error in the garbage collection in the JavaScript engine can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

3) A boundary error in the CSS border rendering implementation may be exploited to write past the end of an array.

4) An integer overflow in the handling of overly long regular expressions in JavaScript may be exploited to execute arbitrary JavaScript bytecode.

5) Two errors in the handling of "-moz-grid" and "-moz-grid-group" display styles may be exploited to execute arbitrary code.

6) An error in the "InstallTrigger.install()" method can be exploited to cause a memory corruption.

7) An unspecified error can be exploited to spoof the secure lock icon and the address bar by changing the location of a pop-up window in certain situations.

Successful exploitation requires that the "Entering secure site" dialog has been enabled (not enabled by default).

8) It is possible to trick users into downloading malicious files via the "Save image as..." menu option.

9) A JavaScript function created via an "eval()" call associated with a method of an XBL binding may be compiled with incorrect privileges. This can be exploited to execute arbitrary code.

10) An error where the "Object.watch()" method exposes the internal "clone parent" function object can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code.

11) An error in the protection of the compilation scope of built-in privileged XBL bindings can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code.

12) An unspecified error can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site via the window.controllers array.

13) An error in the processing of a certain sequence of HTML tags can be exploited to cause a memory corruption.

Successful exploitation allows execution of arbitrary code.

14) An error in the "valueOf.call()" and "valueOf.apply()" methods can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

15) Some errors in the DHTML implementation can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

16) An integer overflow error in the processing of the CSS letter-spacing property can be exploited to cause a heap-based buffer overflow.

Successful exploitation allows execution of arbitrary code.

17) An error in the handling of file upload controls can be exploited to upload arbitrary files from a user's system by e.g. dynamically changing a text input box to a file upload control.

18) An unspecified error in the "crypto.generateCRMFRequest()" method can be exploited to execute arbitrary code.

19) An error in the handling of scripts in XBL controls can be exploited to gain chrome privileges via the "Print Preview" functionality.

20) An error in a security check in the "js_ValueToFunctionObject()" method can be exploited to execute arbitrary code via "setTimeout()" and "ForEach".

21) An error in the interaction between XUL content windows and the history mechanism can be exploited to trick users into interacting with a browser user interface which is not visible.

Successful exploitation may allow execution of arbitrary code.

Solution:

Update to versions 1.0.8 or 1.5.0.2.

I'm not trying to fuel any flames here, but I noticed something.

Various people commented the reason why Opera's track record is so 'clean' was that Secunia withheld information about vulnerabilities until an updated build was made available. It seems as though the same scenario replays itself here for Firefox (unless these vulnerabilities were discovered somewhere else and only made public by Secunia).

BTW, how many of those vulernabilities are 'highly critical'? There's no way each one of them are that critical - if so, this won't work that well in Mozilla's favour.

So, I guess that the lesson here is that all browsers have their share of vulnerabilities. The difference really points to who can update and fix these the fastest.............. and make them available to the general public quickly :yes:

Barney

I'm not trying to fuel any flames here, but I noticed something.

Various people commented the reason why Opera's track record is so 'clean' was that Secunia withheld information about vulnerabilities until an updated build was made available. It seems as though the same scenario replays itself here for Firefox (unless these vulnerabilities were discovered somewhere else and only made public by Secunia).

BTW, how many of those vulernabilities are 'highly critical'? There's no way each one of them are that critical - if so, this won't work that well in Mozilla's favour.

If this is the case, all blame should be squarely placed on Secunia. Mozilla publishes it's flaws http://www.mozilla.org/security/announce/ and you can see what's fixed http://www.mozilla.org/projects/security/k...rabilities.html

Oh, and quite a few of those are 'highly critical' according to mozilla. Secunia lists one a 'extremely critical' and 8 as 'highly critical'.

EDIT: Fixed links

Edited by MrA

If this is the case, all blame should be squarely placed on Secunia. Mozilla publishes it's flaws http://www.mozilla.org/security/announce/ and you can see what's fixed http://www.mozilla.org/projects/security/k...rabilities.html

Oh, and quite a few of those are 'highly critical' according to mozilla. Secunia lists one a 'extremely critical' and 8 as 'highly critical'.

EDIT: Fixed links

Ah, that clarifies it.

Well, good for Mozilla for somehow making Firefox download the 1.5.0.2 update in the background - without prompting me. :shiftyninja:

on a related note, anyone happy that a certain member here was banned before something like this broke out? he would've gloated about new vulnerabilities in Firefox.

http://secunia.com/advisories/19631/

Description:

Multiple vulnerabilities have been reported in Firefox, which can be exploited by malicious people to conduct cross-site scripting and phishing attacks, bypass certain security restrictions, disclose sensitive information, and potentially compromise a user's system.

1) An error exists where JavaScript can be injected into another page, which is currently loading. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

2) An error in the garbage collection in the JavaScript engine can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

3) A boundary error in the CSS border rendering implementation may be exploited to write past the end of an array.

4) An integer overflow in the handling of overly long regular expressions in JavaScript may be exploited to execute arbitrary JavaScript bytecode.

5) Two errors in the handling of "-moz-grid" and "-moz-grid-group" display styles may be exploited to execute arbitrary code.

6) An error in the "InstallTrigger.install()" method can be exploited to cause a memory corruption.

7) An unspecified error can be exploited to spoof the secure lock icon and the address bar by changing the location of a pop-up window in certain situations.

Successful exploitation requires that the "Entering secure site" dialog has been enabled (not enabled by default).

8) It is possible to trick users into downloading malicious files via the "Save image as..." menu option.

9) A JavaScript function created via an "eval()" call associated with a method of an XBL binding may be compiled with incorrect privileges. This can be exploited to execute arbitrary code.

10) An error where the "Object.watch()" method exposes the internal "clone parent" function object can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code.

11) An error in the protection of the compilation scope of built-in privileged XBL bindings can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code.

12) An unspecified error can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site via the window.controllers array.

13) An error in the processing of a certain sequence of HTML tags can be exploited to cause a memory corruption.

Successful exploitation allows execution of arbitrary code.

14) An error in the "valueOf.call()" and "valueOf.apply()" methods can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

15) Some errors in the DHTML implementation can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

16) An integer overflow error in the processing of the CSS letter-spacing property can be exploited to cause a heap-based buffer overflow.

Successful exploitation allows execution of arbitrary code.

17) An error in the handling of file upload controls can be exploited to upload arbitrary files from a user's system by e.g. dynamically changing a text input box to a file upload control.

18) An unspecified error in the "crypto.generateCRMFRequest()" method can be exploited to execute arbitrary code.

19) An error in the handling of scripts in XBL controls can be exploited to gain chrome privileges via the "Print Preview" functionality.

20) An error in a security check in the "js_ValueToFunctionObject()" method can be exploited to execute arbitrary code via "setTimeout()" and "ForEach".

21) An error in the interaction between XUL content windows and the history mechanism can be exploited to trick users into interacting with a browser user interface which is not visible.

Successful exploitation may allow execution of arbitrary code.

Solution:

Update to versions 1.0.8 or 1.5.0.2.

Another great reason to move to Opera, the fastest, most secure browser...Period.

I'm not trying to fuel any flames here, but I noticed something.

Various people commented the reason why Opera's track record is so 'clean' was that Secunia withheld information about vulnerabilities until an updated build was made available. It seems as though the same scenario replays itself here for Firefox (unless these vulnerabilities were discovered somewhere else and only made public by Secunia).

BTW, how many of those vulernabilities are 'highly critical'? There's no way each one of them are that critical - if so, this won't work that well in Mozilla's favour.

It's nothing new. Common courtesy among people that find exploits is generally to notify the vendor before releasing it. They usually wait until they feel a fair amount of time has passed after notifying them before releasing the exploit. Of course I don't know how Secunia gets their exploits, I'm assuming they're already out in the wild when they find them. So at that point, they're just helping to not spread them prior to them being patched.

@Raven or firefox 1.0, where does IE come in here?

It's interesting how these vulnerabilities are mentioned after an updated version is released. It's been a while before .1 was released, and those vulnerabilities were there at the time too. But once again, competition is good, wonder what ms thinks about these fixes.

Thanks for spreading more FUD Neowin! If you'd bothered to check half those bugs, you'd see they're references to fixes that were in the 1.5 and/or 1.5.0.1 releases, and others were variations on exploits or dupes that all got fixed in one bug:

CVE-2006-0749 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1731 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1732 - Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5

CVE-2006-1733 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1734 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1735 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1736 - Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8,

CVE-2006-1737 - This candidate has been reserved by an organization or individual that will use it when announcing a new security problem.

CVE-2006-1738 - This candidate has been reserved by an organization or individual that will use it when announcing a new security problem.

Which leaves the following that were fixed in 1.5.0.2:

CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, CVE-2006-1723 & CVE-2006-1724 all covered by http://www.mozilla.org/security/announce/2...fsa2006-20.html (DHTML crashes with evidence of memory corruption)

and CVE-2006-1725, CVE-2006-1726, CVE-2006-1727, CVE-2006-1728, CVE-2006-1729 & CVE-2006-1730

which is 7 security fixes in 1.5.0.2

Had a user been upgrading from firefox 1.0.7, then your headline "Firefox Update Contains 21 Security Fixes" would be semi-accurate. However, since 99.99% of people were going from 1.5.0.1 to 1.5.0.2, I can't help but think in this case, your "unprofessional journalism" looks decidedly worse to me.

Edited by Cryton
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • The sweet release of death has never looked more appealing.
    • Meh, just another dongle-haven downgrade compared to my Surface Pro 7+. Whenever I decide to upgrade in the next decade or so, it certainly won't be another microslop Surface with this enshitification trend they've been having after the Surface Pro 7+. Hopefully a future generation of the Framework 12 will be a real upgrade...
    • This could exactly be how our Sun ends but it's not as simple by Sayan Sen Image by Drew Rae via Pexels An international team led by Université de Montréal (University of Montreal) PhD student Érika Le Bourdais has found that the ancient white dwarf star LSPM J0207+3331 is still pulling in planetary debris, even though it has been cooling for about three billion years. White dwarfs are dense, Earth-sized stellar remnants left behind when Sun-like stars exhaust their nuclear fuel and shed their outer layers. The star, located 145 light-years away in the constellation Triangulum, is the oldest and coldest white dwarf known to have a surrounding disk of dust. The star was first spotted in 2019 by a citizen scientist through the Backyard Worlds: Planet 9 project. Its cool temperature immediately suggested that it was very old, since white dwarfs gradually lose heat over time. Using the W. M. Keck telescopes in Hawaii, astronomers later confirmed that the star shows infrared signals consistent with dust rings formed by asteroids breaking apart under its strong gravity. Such infrared excesses occur when a star emits more infrared light than expected, often because warm dust surrounding it absorbs and re-radiates energy. “This discovery challenges our understanding of planetary system evolution,” said Le Bourdais. “The fact that we still see planetary debris being accreted three billion years after the star became a white dwarf suggests that asteroids, comets, and even planets can remain in orbit around these stars for a very long time.” Spectroscopic analysis—a technique that studies light to identify the chemical elements present in an object—revealed thirteen heavy elements in the star’s atmosphere: sodium, magnesium, aluminium, silicon, calcium, titanium, chromium, manganese, iron, cobalt, nickel, copper, and strontium. Normally, heavy elements sink quickly in hydrogen-rich white dwarfs, making them hard to detect. “We expected to see only a few elements, but we found dozens!” explained Le Bourdais. The research paper adds more detail. The absence of carbon features suggests the debris came from a carbon-volatile-depleted source. The abundance pattern shows slight deficits of magnesium and silicon compared to iron but otherwise resembles Earth-like material. This points to a differentiated rocky body—one whose materials have separated into distinct layers such as a metallic core and rocky mantle—with a metallic core fraction higher than Earth’s. In other words, the star is accreting the remains of a large rocky object, similar in structure to Earth or the asteroid Vesta. “White dwarfs offer one of the only ways we can directly measure the composition of exoplanets,” said Patrick Dufour, co-author and professor at Université de Montréal. “When planetary debris come too close, they are torn apart by the star’s gravity and end up polluting its atmosphere, leaving a detailed chemical fingerprint of its composition.” The team also detected weak Ca II H & K line core emission, making this only the second known isolated polluted white dwarf to show this feature. These are specific spectral signatures produced by ionised calcium and can indicate unusual physical activity in a star’s upper atmosphere. The finding suggests that extra physical processes may be happening in or above the star’s upper atmosphere. The study stresses the importance of including heavy elements in model atmosphere calculations, since leaving them out can distort the inferred structure and lead to inaccurate stellar parameters. Earlier work suggested the star’s infrared excess came from two dust rings. The new analysis shows that a single silicate dust disk—a ring composed largely of rock-forming minerals rich in silicon and oxygen—can explain the observed signal at 11.6 μm, simplifying the picture of the system’s structure. The question of how debris ended up falling into the star so late remains open. One idea is that giant planets in the system slowly destabilised smaller bodies over billions of years. Another possibility is that a passing star disturbed the orbits of debris. “Future observations with the James Webb Space Telescope or archival data found in the European Space Agency’s Gaia mission could help distinguish between a planetary rearrangement and the gravitational effect of a close stellar encounter,” said John Debes, co-author and researcher at the Space Telescope Science Institute. Dufour noted that hydrogen-rich white dwarfs are the most common type, and the coolest among them are the oldest stars in the galaxy. “We didn't have the habit of looking for signs of accretion in them. This unique case motivates us to expand our search to more of these stars.” The findings show that even after billions of years, planetary systems can remain active and complex. Substantial accretion events—the gradual accumulation of surrounding material onto a celestial object—can still occur long after a star’s death, offering a rare window into the composition and fate of distant worlds. Source: University of Montreal, IOPScience This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • Doesn't DDG mainly use Bing?
  • Recent Achievements

    • One Year In
      MadMung0 earned a badge
      One Year In
    • Week One Done
      jefred earned a badge
      Week One Done
    • Apprentice
      JoeyNeo went up a rank
      Apprentice
    • Week One Done
      oliviaexpo earned a badge
      Week One Done
    • Week One Done
      eurospharma62 earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      480
    2. 2
      PsYcHoKiLLa
      228
    3. 3
      Skyfrog
      67
    4. 4
      FloatingFatMan
      58
    5. 5
      neufuse
      55
  • Tell a friend

    Love Neowin? Tell a friend!