Daily cyber threats and internet security news: network security, online safety and latest security alerts
March 5th, 2009

Critical Memory Flaws Fixed By Mozilla In Firefox 3.0.7

Mozilla has released a new version of Firefox in response to the discovery of several security flaws in the browser software. The most serious of the vulnerabilities could be exploited by attackers to run code and install software, requiring no user interaction beyond normal browsing.

Version 3.0.7 of Firefox plugs five security vulnerabilities, three of which tagged as “critical”. Of these critical flaws a bug that means that Firefox crashes with evidence of memory corruption stands out as the most severe. Critical flaws in Mozilla’s garbage collection process (involving memory management and “cloned XUL DOM elements”) as well as bugs in the PNG library used by Mozilla also create a possible means for hackers to inject malware onto vulnerable systems.

The Firefox update also fixes less severe bugs. Mozilla’s Thunderbird email client and SeaMonkey application suite share a similar code base to Firefox and therefore also need updating, to Thunderbird and SeaMonkey 1.1.15, respectively.

The Firefox update includes:

MFSA 2009-11 (Low risk) Mozilla contributor Masahiro Yamada reported that certain invisible control characters were being decoded when displayed in the location bar, resulting in fewer visible characters than were present in the actual location. An attacker could use this vulnerability to spoof the location bar and display a misleading URL for their malicious web page.

MFSA 2009-10 (Critical) libpng maintainer Glenn Randers-Pehrson reported several memory safety hazards in PNG libraries used by Mozilla. These vulnerabilities could be used by a malicious website to crash a victim’s browser and potentially execute arbitrary code on their computer. libpng was upgraded to a version which contained fixes for these flaws.

MFSA 2009-09 (High risk) Mozilla security researcher Georgi Guninski reported that a website could use nsIRDFService and a cross-domain redirect to steal arbitrary XML data from another domain, a violation of the same-origin policy. This vulnerability could be used by a malicious website to steal private data from users authenticated to the redirected website.

MFSA 2009-08 (Critical) An anonymous researcher, via TippingPoint’s Zero Day Initiative program, reported a vulnerability in Mozilla’s garbage collection process. The vulnerability was caused by improper memory management of a set of cloned XUL DOM elements which were linked as a parent and child. After reloading the browser on a page with such linked elements, the browser would crash when attempting to access an object which was already destroyed. An attacker could use this crash to run arbitrary code on the victim’s computer.

MFSA 2009-07 (Critical) Four different vulnerabilities leading to browser crashes with evidence of memory corruption.

Malware exploiting the bugs is yet to be seen in circulation, but that’s a poor reason to hold off upgrading. Those who have enabled Mozilla’s automated update process should find that new software is installed within a day or so.

Share this item with others:

More on CyberInsecure:
  • Firefox Update Patch 9 Security Vulnberabilities, 4 Rated Critical
  • Firefox Is Out
  • Mozilla Fixes 12 Security Vulnerabilities In Firefox
  • Five Vulnerabilities Patched In Firefox 3.0.2 and, Two Of Them Are Critical
  • Firefox 3.0.4, Firefox And Seamonkey 1.1.13 Released, 11 Security Vulnerabilities Patched, 4 Of Them Critical

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: Critical Memory Flaws Fixed By Mozilla In Firefox 3.0.7

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.