We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Critical Firefox fix misses several flaws

Mozilla update patches 14 vulnerabilities

Mozilla has updated Firefox to patch 14 vulnerabilities, three of them critical, but pushed out the new versions without fixing several flaws.

Firefox and Firefox, which were originally due to launch last Wednesday, were delayed to patch a series of bugs, including some disclosed this month by Polish researcher Michal Zelewski. Two others forwarded to Mozilla developers by Zelewski, however, didn't make it into the new updates.

"Neither of those will make this release," said Daniel Veditz, of the Mozilla security team. "It is important that we get the security fixes we have into the hands of our users."

Of the bugs filed by Zelewski but not fixed in the updates, the most serious is a memory corruption flaw that could let attackers inject code remotely into Firefox-equipped machines simply by duping users into visiting a malicious web page. "Firefox is susceptible to a seemingly pretty nasty, and apparently easily exploitable, memory corruption vulnerability," wrote Zelewski in the Bugzilla database.

Security vendor Symantec agreed. "Successfully exploiting this issue may allow remote attackers to execute arbitrary machine code in the context of the affected application. This could facilitate the remote compromise of affected computers," it reported in an alert sent to subscribers to its DeepSight threat system. US-CERT, the federally funded vulnerability monitoring centre, also issued a warning on Friday, and recommended that Firefox users disable JavaScript.

Also unrepaired in the latest browser versions is a third Zelewski-discovered bug that could give cybercriminals a leg up when running phishing attacks.

Mozilla spelled out the security fixes in Firefox and here.

Firefox is nearly at the end of its supported lifespan. After 24 April, Mozilla will stop issuing security and stability updates to that edition.

Firefox can be downloaded from the Mozilla website in versions for Windows, Mac OS X and Linux in 36 languages. Users can also update current editions with the Check for Updates command in the Help menu.

IDG UK Sites

Acer Aspire R11 review: Hands-on with the 360 laptop and tablet convertible

IDG UK Sites

Apple Watch release day: Twitter reacts

IDG UK Sites

See how Framestore created a shape-shifting, oil and metal based creature for Shell

IDG UK Sites

Apple Watch buying guide, price list & where to buy today: Which Apple Watch model, size, material,?......