21 Firefox vulnerabilities reported today


Recommended Posts

http://secunia.com/advisories/19631/

Description:

Multiple vulnerabilities have been reported in Firefox, which can be exploited by malicious people to conduct cross-site scripting and phishing attacks, bypass certain security restrictions, disclose sensitive information, and potentially compromise a user's system.

1) An error exists where JavaScript can be injected into another page, which is currently loading. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

2) An error in the garbage collection in the JavaScript engine can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

3) A boundary error in the CSS border rendering implementation may be exploited to write past the end of an array.

4) An integer overflow in the handling of overly long regular expressions in JavaScript may be exploited to execute arbitrary JavaScript bytecode.

5) Two errors in the handling of "-moz-grid" and "-moz-grid-group" display styles may be exploited to execute arbitrary code.

6) An error in the "InstallTrigger.install()" method can be exploited to cause a memory corruption.

7) An unspecified error can be exploited to spoof the secure lock icon and the address bar by changing the location of a pop-up window in certain situations.

Successful exploitation requires that the "Entering secure site" dialog has been enabled (not enabled by default).

8) It is possible to trick users into downloading malicious files via the "Save image as..." menu option.

9) A JavaScript function created via an "eval()" call associated with a method of an XBL binding may be compiled with incorrect privileges. This can be exploited to execute arbitrary code.

10) An error where the "Object.watch()" method exposes the internal "clone parent" function object can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code.

11) An error in the protection of the compilation scope of built-in privileged XBL bindings can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code.

12) An unspecified error can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site via the window.controllers array.

13) An error in the processing of a certain sequence of HTML tags can be exploited to cause a memory corruption.

Successful exploitation allows execution of arbitrary code.

14) An error in the "valueOf.call()" and "valueOf.apply()" methods can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

15) Some errors in the DHTML implementation can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

16) An integer overflow error in the processing of the CSS letter-spacing property can be exploited to cause a heap-based buffer overflow.

Successful exploitation allows execution of arbitrary code.

17) An error in the handling of file upload controls can be exploited to upload arbitrary files from a user's system by e.g. dynamically changing a text input box to a file upload control.

18) An unspecified error in the "crypto.generateCRMFRequest()" method can be exploited to execute arbitrary code.

19) An error in the handling of scripts in XBL controls can be exploited to gain chrome privileges via the "Print Preview" functionality.

20) An error in a security check in the "js_ValueToFunctionObject()" method can be exploited to execute arbitrary code via "setTimeout()" and "ForEach".

21) An error in the interaction between XUL content windows and the history mechanism can be exploited to trick users into interacting with a browser user interface which is not visible.

Successful exploitation may allow execution of arbitrary code.

Solution:

Update to versions 1.0.8 or 1.5.0.2.

I'm not trying to fuel any flames here, but I noticed something.

Various people commented the reason why Opera's track record is so 'clean' was that Secunia withheld information about vulnerabilities until an updated build was made available. It seems as though the same scenario replays itself here for Firefox (unless these vulnerabilities were discovered somewhere else and only made public by Secunia).

BTW, how many of those vulernabilities are 'highly critical'? There's no way each one of them are that critical - if so, this won't work that well in Mozilla's favour.

So, I guess that the lesson here is that all browsers have their share of vulnerabilities. The difference really points to who can update and fix these the fastest.............. and make them available to the general public quickly :yes:

Barney

I'm not trying to fuel any flames here, but I noticed something.

Various people commented the reason why Opera's track record is so 'clean' was that Secunia withheld information about vulnerabilities until an updated build was made available. It seems as though the same scenario replays itself here for Firefox (unless these vulnerabilities were discovered somewhere else and only made public by Secunia).

BTW, how many of those vulernabilities are 'highly critical'? There's no way each one of them are that critical - if so, this won't work that well in Mozilla's favour.

If this is the case, all blame should be squarely placed on Secunia. Mozilla publishes it's flaws http://www.mozilla.org/security/announce/ and you can see what's fixed http://www.mozilla.org/projects/security/k...rabilities.html

Oh, and quite a few of those are 'highly critical' according to mozilla. Secunia lists one a 'extremely critical' and 8 as 'highly critical'.

EDIT: Fixed links

Edited by MrA

If this is the case, all blame should be squarely placed on Secunia. Mozilla publishes it's flaws http://www.mozilla.org/security/announce/ and you can see what's fixed http://www.mozilla.org/projects/security/k...rabilities.html

Oh, and quite a few of those are 'highly critical' according to mozilla. Secunia lists one a 'extremely critical' and 8 as 'highly critical'.

EDIT: Fixed links

Ah, that clarifies it.

Well, good for Mozilla for somehow making Firefox download the 1.5.0.2 update in the background - without prompting me. :shiftyninja:

on a related note, anyone happy that a certain member here was banned before something like this broke out? he would've gloated about new vulnerabilities in Firefox.

http://secunia.com/advisories/19631/

Description:

Multiple vulnerabilities have been reported in Firefox, which can be exploited by malicious people to conduct cross-site scripting and phishing attacks, bypass certain security restrictions, disclose sensitive information, and potentially compromise a user's system.

1) An error exists where JavaScript can be injected into another page, which is currently loading. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

2) An error in the garbage collection in the JavaScript engine can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

3) A boundary error in the CSS border rendering implementation may be exploited to write past the end of an array.

4) An integer overflow in the handling of overly long regular expressions in JavaScript may be exploited to execute arbitrary JavaScript bytecode.

5) Two errors in the handling of "-moz-grid" and "-moz-grid-group" display styles may be exploited to execute arbitrary code.

6) An error in the "InstallTrigger.install()" method can be exploited to cause a memory corruption.

7) An unspecified error can be exploited to spoof the secure lock icon and the address bar by changing the location of a pop-up window in certain situations.

Successful exploitation requires that the "Entering secure site" dialog has been enabled (not enabled by default).

8) It is possible to trick users into downloading malicious files via the "Save image as..." menu option.

9) A JavaScript function created via an "eval()" call associated with a method of an XBL binding may be compiled with incorrect privileges. This can be exploited to execute arbitrary code.

10) An error where the "Object.watch()" method exposes the internal "clone parent" function object can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code.

11) An error in the protection of the compilation scope of built-in privileged XBL bindings can be exploited to execute arbitrary JavaScript code with escalated privileges.

Successful exploitation allows execution of arbitrary code.

12) An unspecified error can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site via the window.controllers array.

13) An error in the processing of a certain sequence of HTML tags can be exploited to cause a memory corruption.

Successful exploitation allows execution of arbitrary code.

14) An error in the "valueOf.call()" and "valueOf.apply()" methods can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

15) Some errors in the DHTML implementation can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

16) An integer overflow error in the processing of the CSS letter-spacing property can be exploited to cause a heap-based buffer overflow.

Successful exploitation allows execution of arbitrary code.

17) An error in the handling of file upload controls can be exploited to upload arbitrary files from a user's system by e.g. dynamically changing a text input box to a file upload control.

18) An unspecified error in the "crypto.generateCRMFRequest()" method can be exploited to execute arbitrary code.

19) An error in the handling of scripts in XBL controls can be exploited to gain chrome privileges via the "Print Preview" functionality.

20) An error in a security check in the "js_ValueToFunctionObject()" method can be exploited to execute arbitrary code via "setTimeout()" and "ForEach".

21) An error in the interaction between XUL content windows and the history mechanism can be exploited to trick users into interacting with a browser user interface which is not visible.

Successful exploitation may allow execution of arbitrary code.

Solution:

Update to versions 1.0.8 or 1.5.0.2.

Another great reason to move to Opera, the fastest, most secure browser...Period.

I'm not trying to fuel any flames here, but I noticed something.

Various people commented the reason why Opera's track record is so 'clean' was that Secunia withheld information about vulnerabilities until an updated build was made available. It seems as though the same scenario replays itself here for Firefox (unless these vulnerabilities were discovered somewhere else and only made public by Secunia).

BTW, how many of those vulernabilities are 'highly critical'? There's no way each one of them are that critical - if so, this won't work that well in Mozilla's favour.

It's nothing new. Common courtesy among people that find exploits is generally to notify the vendor before releasing it. They usually wait until they feel a fair amount of time has passed after notifying them before releasing the exploit. Of course I don't know how Secunia gets their exploits, I'm assuming they're already out in the wild when they find them. So at that point, they're just helping to not spread them prior to them being patched.

@Raven or firefox 1.0, where does IE come in here?

It's interesting how these vulnerabilities are mentioned after an updated version is released. It's been a while before .1 was released, and those vulnerabilities were there at the time too. But once again, competition is good, wonder what ms thinks about these fixes.

Thanks for spreading more FUD Neowin! If you'd bothered to check half those bugs, you'd see they're references to fixes that were in the 1.5 and/or 1.5.0.1 releases, and others were variations on exploits or dupes that all got fixed in one bug:

CVE-2006-0749 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1731 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1732 - Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5

CVE-2006-1733 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1734 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1735 - Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8

CVE-2006-1736 - Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8,

CVE-2006-1737 - This candidate has been reserved by an organization or individual that will use it when announcing a new security problem.

CVE-2006-1738 - This candidate has been reserved by an organization or individual that will use it when announcing a new security problem.

Which leaves the following that were fixed in 1.5.0.2:

CVE-2006-1529, CVE-2006-1530, CVE-2006-1531, CVE-2006-1723 & CVE-2006-1724 all covered by http://www.mozilla.org/security/announce/2...fsa2006-20.html (DHTML crashes with evidence of memory corruption)

and CVE-2006-1725, CVE-2006-1726, CVE-2006-1727, CVE-2006-1728, CVE-2006-1729 & CVE-2006-1730

which is 7 security fixes in 1.5.0.2

Had a user been upgrading from firefox 1.0.7, then your headline "Firefox Update Contains 21 Security Fixes" would be semi-accurate. However, since 99.99% of people were going from 1.5.0.1 to 1.5.0.2, I can't help but think in this case, your "unprofessional journalism" looks decidedly worse to me.

Edited by Cryton
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Microsoft OneDrive is getting a simple yet much needed feature by Sayan Sen Microsoft has been steadily expanding OneDrive’s file management capabilities over the years, including for shared content and shortcuts, although it has had its flaws, too. The cloud storage platform introduced support for folder shortcuts several years ago, allowing users to pin frequently accessed shared folders from OneDrive, SharePoint, and Teams. Now, Microsoft is refining that experience further with a new way to organize those shortcuts as revealed in a recent Microsoft 365 roadmap addition. Previously, shortcuts added through the “Add shortcut to My files” option would appear alongside all other files and folders in the root of a user's OneDrive. And although it's meant to be useful, this approach could also create clutter along the way, especially for heavy users who may have to work with large numbers of shared folders across multiple projects and teams on their systems. This is where Microsoft’s latest feature comes in, as it is looking to address this inconvenience by giving users the option to place new shortcuts inside a dedicated “Shortcuts” folder instead. The feature is designed to keep shortcut links organized into a single location instead of scattering throughout the main OneDrive directory. Hence, the idea is to make navigation and usability easier and simpler. The first time a user chooses this option, OneDrive will automatically create the folder, and to help make it stand out from the other folders, the Shortcuts folder will have a distinct visual identity featuring a unique color and a building-style icon. That being said, the new Shortcuts will behave just like any other folder in OneDrive, and as such, users will be able to move it to a different location, rename it, share it with others, or remove it entirely if they prefer a different structure. You can view the entry on the Microsoft 365 roadmap website here. Currently, the feature is in the "in development" phase, but the tech giant expects the rollout to start next month (July 2026). Do keep in mind, though, that new feature rollouts often get delayed.
    • VS Code 1.123 introduces massive upgrades for persistent AI developer workflows by Paul Hill Microsoft has just released Visual Studio Code 1.123 alongside its annual developer conference, Build 2026. This release, as always, has a heavy focus on advanced AI agent integration and making the built-in browser more robust. Notably, this update brings big sync changes that keep your AI agents persistent across sessions. With this update, VS Code now supports cross-machine syncing for chat histories, touched files, repository contexts, and related PRs via GitHub accounts, tying users even more into Microsoft’s developer ecosystem. This update also introduces the new /chronicle command that allows you to query past sessions using natural language, generate instant standup reports, and get personal productivity insights. Microsoft has also made some improvements to network-dependent operations, it explains: “When a terminal command that is run by a local agent requires access to domains that are not configured as allowed domains, the command is automatically retried inside the sandbox with unrestricted network access. After that, if it still fails, it falls back to unsandboxed execution. This allows network-dependent operations such as git fetch to finish, while keeping filesystem protections in place.” Microsoft has not stopped there; in this update, it also allows developers to drag, drop, and pin multiple agent sessions side-by-side for easy code comparisons in real-time. It also introduces the Research Agent, accessible via /research. This is a read-only, depth-optimized tool that gets data from the web, local codebase, and GitHub to give you a Markdown report on complex APIs or unfamiliar code. Now, let’s talk about the integrated browser and some security enhancements. VS Code 1.123 features enhanced screenshot capture tools that allow for targeted Area Screenshots and Full Page Screenshots to send layout context instantly to AI chat. The address bar has also been revamped, supporting favorite pages and tab management. Finally, on the security front, this update introduces a safety-first two-hour delay on third-party extension auto-updates to safeguard against compromised or buggy releases. This release is now available for Windows, Mac, and Linux. If you have VS Code, keep an eye out for the update availability notification. If you still don’t have VS Code, you can get it here.
    • I'm hoping with the Surface Pro 12, I can use either USB-C for my Xreal One Pro glasses. With my Surface Pro 11 OLED X Elite, I have to plug them into the top port. The bottom port will power it, but nothing shows on the screen. Maybe it's my setting. When I plug in the glasses, I have it output only to the glasses. So maybe I need to turn on both displays with it in the top port, then switch the glasses to the bottom port and set it to output only to the glasses. And then hopefully Windows remembers the settings for either the top port and bottom port (one of the awesome features of Windows where it remembers the exact configuration when plugging in external monitors.
    • Forgive my ignorance, but the only difference I see here is that a USB-A is now a USB-C, so there are two of them. For the modern age (and I'd argue since 2020), most products would now come with USB-C as an option, if not the default. Display, charging, devices, etc on TWO connectors, sometimes all combined! So having 2 of those powerful ports is great for something this size! Meanwhile my Surface Pro (5) has a single USB-A port which I cannot even get display out to, instead relying on some Surface Connect dock which I don't have. That is a poor experience, not to mention expensive and not compatible with other devices. Thank God USB-C is mainstream!
    • wow. that color finally comes to Surface Pro. was always a little jelly when a friend had the sandstone Surface Laptop. I wonder how different this dune is from the sandstone. I'll be getting the dune version. always thought black and platinum were a little boring. I'll still have access to my blue Surface Pro 11 as it'll be a hand-me-down.
  • Recent Achievements

    • One Month Later
      B2Proxy earned a badge
      One Month Later
    • One Year In
      MadMung0 earned a badge
      One Year In
    • Week One Done
      jefred earned a badge
      Week One Done
    • Apprentice
      JoeyNeo went up a rank
      Apprentice
    • Week One Done
      oliviaexpo earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      482
    2. 2
      PsYcHoKiLLa
      227
    3. 3
      Skyfrog
      71
    4. 4
      FloatingFatMan
      60
    5. 5
      Nick H.
      54
  • Tell a friend

    Love Neowin? Tell a friend!