Mozilla discloses more Firefox flaws

Patched 10 vulnerabilities in Firefox 3.6.2, reveals info on three bugs fixed last month

Editor's note: An earlier version of this story erroneously stated that Mozilla had released technical details of unpatched vulnerabilities. Those flaws were actually patched in February. Mozilla patched more than one vulnerability in Firefox when it updated the browser to version 3.6.2 on Monday, the company confirmed today.

A total of 10 flaws were fixed in Firefox 3.6.2, according to Mozilla's security advisory page, but details of others have been withheld until the company updates the older Firefox 3.0 and Firefox 3.5 browsers. Mozilla is scheduled to ship the updates, Firefox 3.0.19 and Firefox 3.5.9, next Tuesday, March 30.

Mozilla accelerated the release of Firefox 3.6.2 because a Russian researcher had announced a critical vulnerability in how the browser decodes the Web Open Font Format (WOFF), a Web-based font standard. Only Firefox 3.6 supports WOFF.

However, three of the vulnerabilities already patched in Firefox 3.6.2 also apply to older editions of the browser: One of the 10 fixed flaws that Mozilla ranked as "low" in its four step scoring system, one tagged as "high" and one marked as "critical."

Mozilla patched those bugs last month when it issued Firefox 3.0.18 and Firefox 3.5.8

Mozilla has rushed out fixes before, although -- like rival browser maker Microsoft -- it does so rarely. Last March, for example, Mozilla updated Firefox 3.0 to patch a pair of vulnerabilities, including one that had been used the week before by a German college student to hack the browser and take home $5,000 for his efforts at the Pwn2Own contest.

The bug quashed Monday -- and for a day, the only one for which information was published -- was disclosed by Russian researcher Evgeny Legerov in February. Initially, Legerov refused to provide proof of his exploit claims to Mozilla, prompting some to question his motives or wonder whether it was a hoax. According to Mozilla's Bugzilla change- and bug-tracking database, Legerov finally verified the vulnerability with the company's developers on March 13.

Mozilla has been under pressure to provide a patch. Last Friday, for instance, the German government's computer security agency urged users to abandon Firefox until a fix is available. Buerger-CERT, part of the Federal Office for Security in Information Technology, which is known by its German initials of BSI, retracted that recommendation yesterday, after Mozilla released Firefox 3.6.2.

Later today, Firefox -- as well as Microsoft's Internet Explorer, Google's Chrome and Apple's Safari -- will face several notable hackers at Pwn2Own, a contest that pits researchers against four notebooks running the browsers. Among those eager to go for the $5,000 cash prizes are two former winners, including a German college student who successfully exploited Firefox last year.

Next week's Firefox 3.0.19 will be the last security update for the 2008 browser, Mozilla has announced previously. Users running that edition have been urged to update to Firefox 3.6.

In other news from Mozilla, the company will probably ship "Lorentz" with the next iteration of its standard Firefox security releases, Firefox 3.5.10 and Firefox 3.6.3. Lorentz is the codename for an in-place upgrade that will add several features to the browser. The most notable change will be to separate external plug-ins, such as Adobe's Flash, from Firefox's other processes so that if the plug-in crashes, the browser won't follow suit.

Mozilla has not set a release timetable for the release of Firefox 3.5.10 and Firefox 3.6.3.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com.

From CIO: 8 Free Online Courses to Grow Your Tech Skills
Join the discussion
Be the first to comment on this article. Our Commenting Policies