Netstat -vat by Sean Michael Kerner (bio )

A command line view of IT

« Microsoft's Linux Best Buy is great news | Sean Michael Kerner Blog | Microsoft launches open source foundation »

Mozilla Firefox 3.5.3 patches a trio of critical vulns

By Sean Michael Kerner on September 10, 2009 9:37 AM

From the 'Time To Update' files:

Mozilla is updating its Firefox web browser to plug holes in its own software and to help prevent users from running other vendors vulnerable software as well.

Firefox 3.5.3 is being released with three critical bug security advisories from Mozilla. There is, "Crashes with evidence of memory corruption" advisory as has been the case with many Firefox release over the past two years.

"Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code," Mozilla states in its advisory.

There is also an interesting, "TreeColumns dangling pointer vulnerability" that was reported to Mozilla by way of the Tipping Point Zero Day Initiative (ZDI). ZDI pays security researchers for their vulnerabilities and then responsibly discloses them to vendors so they can be fixed.

The tree element flaw deals with a XUL (XML User-interface Language) element that could have been abused to let an attacker potentially run arbitrary code.

The final critical advisory issued by Mozilla is privilege escalation issue in the BrowserFeedWriter element.

"Using this vulnerability, an attacker could construct an object containing malicious JavaScript and cause the FeedWriter to process the object, running the malicious code with chrome privileges," Mozilla's advisory states.

Firefox 3.5.3 is also the first first Firefox release to check that the Adobe Flash plug-in on a user's system is up to date. It's a really important addition.

Back in in August, I wrote a story about one security vendor's claims that 80 percent of Adobe Flash users were running old versions. I'm not entirely certain of how accurate that claim might be, but I do know that a certain percentage of users are running old versions of Flash.

Now finally, with the browser (which is how most of us access Flash content on the web) checking Flash versions, maybe we'll see more users running the most recent version.

Browser security is about more than just the browser itself after all. It's about the whole ecosystem of vendors and software that a browser user relies on.

Permalink | Comments (0) | TrackBacks (0) | Share