Post by kas on Apr 29, 2011 11:11:27 GMT -5
The first update to Firefox 4.0, version 4.0.1, addresses a total of three vulnerabilities, two of which are rated as critical. The browser's WebGLES feature contains bugs that could lead to crashes, potentially resulting in the execution of malicious code. The Windows version of Firefox was also found to have been compiled without ASLR which could allow an attacker to bypass ASLR's protection against malicious code if a memory corruption flaw was found. Several critical memory safety bugs have in the browser engine used by Firefox have also been corrected. These bugs reportedly contained evidence of memory corruption under certain circumstances. The developers presume that, with enough effort, some of them could be exploited to run arbitrary code.
Updates have also been issued for the 3.5.x and 3.6.x branches of Firefox. These updates, versions 3.5.19 and 3.6.17, address the same memory safety bugs noted above, as well as five other vulnerabilities. The legacy branches of Firefox contain two further critical holes, a privilege escalation problem in the Java Embedding Plugin (JEP) which shipped with Mac OS X versions, and multiple dangling pointer vulnerabilities. Two moderate risk bugs and one low risk bug have also been corrected. The developers note that version 3.5.19 of Firefox will be the last planned security and stability update for the 3.5 branch and encourage all users to upgrade to the 4.0.x branch of Firefox.
Updates have also been issued for the 3.5.x and 3.6.x branches of Firefox. These updates, versions 3.5.19 and 3.6.17, address the same memory safety bugs noted above, as well as five other vulnerabilities. The legacy branches of Firefox contain two further critical holes, a privilege escalation problem in the Java Embedding Plugin (JEP) which shipped with Mac OS X versions, and multiple dangling pointer vulnerabilities. Two moderate risk bugs and one low risk bug have also been corrected. The developers note that version 3.5.19 of Firefox will be the last planned security and stability update for the 3.5 branch and encourage all users to upgrade to the 4.0.x branch of Firefox.
Read more The H Security