latest updates from easySERVICE™
Mozilla released 10 patches for three versions of its Firefox browser on Tuesday, five of which are considered critical and could be used to remotely install malicious code.
The U.S. Computer Emergency Readiness Team warned that the problems “could allow a remote attacker to execute arbitrary code, bypass intended access restrictions, cause a denial-of-service condition or obtain sensitive information.”
Those bugs, tagged as update MFSA 2013-93, “showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code,” according to Mozilla’s advisory.
The other four critical vulnerabilities could cause potentially exploitable crashes, Mozilla said.
One of the vulnerabilities given a “high” risk rating, MFSA 2013-99, could divulge information on a computer’s local system. A security researcher, Cody Crews, discovered “a method to append an iframe into an embedded PDF object rendered with the chrome privileged PDF.js.”
“This can used to bypass security restrictions to load local or chrome privileged files and objects within the embedded PDF object,” Mozilla wrote.
In August, the TOR project warned that a vulnerability in Firefox ESR may have been used to collect information on computers visiting websites configured as TOR hidden services.
TOR, short for The Onion Router, is a system that allows for more anonymous browsing by routing encrypted requests for websites through servers worldwide. The TOR Project distributes a Browser Bundle, which includes Firefox for browsing with TOR.
The vulnerability could have facilitated the execution of remote code, but instead may have been used to collect the hostname and MAC address of Windows computers, it said. The TOR Project typically updates its browser bundle package quickly after Mozilla releases new patches.
Have something to add to this story? Share it in the comments.
Source: Associated Press