We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,671 News Articles

Firefox users urged to install 'critical' fix

Mozilla patches bug ahead of hacking contest

Mozilla has patched its flagship Firefox browser, just days before the start of a hacking contest set to target web browser vulnerabilities.

The Firefox 3.6.2 update fixes a critical bug in a font decompression routine that could be exploited to "crash a victim's browser and execute arbitrary code on his/her system", Mozilla said in a security advisory.

Mozilla had been under pressure to fix the bug, after it was included by Russian security researcher Evgeny Legerov last month in his VulnDisco hacking tool, which is sold as an add-on to the Canvas penetration testing kit. The Firefox team had expected to fix the issue next week, but decided to rush out an earlier update, apparently out of concern that Legerov's code could be misused.

The flaw affects Firefox 3.6, but not earlier versions of the browser, Mozilla said.

In his February forum post disclosing the vulnerability, Legerov said that it affected the browser running on Windows XP and Vista.

The flaw lies in the way Firefox implements a web-based font standard called the Web Open Font Format.

The Firefox update comes as hackers prepare to compete in a three-day contest at Vancouver's CanSecWest security conference. During the Pwn2Own event, contestants will try to break into computers by using previously undisclosed bugs in Firefox, Internet Explorer, Safari, and Chrome. Winners will take home the laptop they break into, as well as a $10,000 cash prize.

Mozilla is in good company, updating its software ahead of the contest. Apple and Google have also fixed their browsers in the past few weeks.

Contest organisers had previously stated that Legerov's bug wouldn't count if used in their contest, however, since it's already been disclosed.

Firefox 3.6.2 is available for Windows, Mac, and Linux users.

See more:

PC security advice


IDG UK Sites

Nokia replaces budget Lumia 520 with 530: Release date, price and specs

IDG UK Sites

Everything you need to know about Apple's iPhone Camera in iOS 8

IDG UK Sites

Why you shouldn't trust password managers

IDG UK Sites

How to make an 'Apple iWatch' using an iPod nano and a 3D printer