Mozilla Developers Remove Critical Bugs
The Mozilla Foundation has removed at least ten vulnerabilities from its browser, three of which were classified as critical by the developers.
One of the critical bugs gave attackers the ability to execute Javascript with chrome privileges. The bug report MFSA 2008-03 also mentions a vulnerability in the "XMLDocument.load" function which could be exploited to inject Javascript into a frame outside the original frame and thus work around the browser's same origin policy.
The Mozilla developers discovered various bugs in the Mozilla Browser Engine; although they are not described in more detail it is understood that they were capable of crashing the browser and thus giving attackers the ability to inject and execute malicious code. The bug described in MFSA 2008-01 also affects the Thunderbird mail client. The next version of Thunderbird will include a fix.
The third critical vulnerability, MFSA 2008-06, gave attackers the ability to parse the browser history via a "designMode" frame on a manipulated website. The attack could crash the browser thus giving attackers the ability to inject malicious code. MFSA 2008-10 desccribes another vulnerability caused by Javascript which allowed for URL hijacking using the "302 Redirect" function in HTML code.
The vulnerabilities described here can be avoided by temporarily disabling Javascript. The Mozilla Foundation's Security page describes these bugs and other security-relevant issues. Besides the Firefox browser, Seamonkey and Camino are affected. An updated version of Firefox (version 2.0.12) is available from the Mozilla servers. Distributors are likely to release updated packages in the next few days. Version 1.1.8 of the Seamonkey browser suite is also available for downloading.
Issue 230/2020
Buy this issue as a PDF
News
-
Elementary OS 5.1 Has Arrived
One of the most highly regarded Linux desktop distributions has released its next iteration.
-
Linux Mint 19.3 Will be Released by Christmas
The developers behind Linux Mint have announced 19.3 will be released by Christmas 2019.
-
Linux Kernel 5.4 Released
A number of new changes and improvements have reached the Linux kernel.
-
System76 To Design And Build Laptops In-House
In-house designed and built laptops coming from System76.
-
News and views on the GPU revolution in HPC and Big Data:
-
The PinePhone Pre-Order has Arrived
Anyone looking to finally get their hands on an early release of the PinePhone can do so as of November 15.
-
Microsoft Edge Coming to Linux
Microsoft is bringing it’s new Chromium-based Edge browser to Linux.
-
Open Invention Network Backs Gnome Project Against Patent Troll
OIN has deployed its legal team to find prior art.
-
Fedora 31 Released
The latest version of Fedora comes with new packages and libraries.
-
openSUSE OBS Can Now Build Windows WSL Images
openSUSE enables developers to build their own WSL distributions.