Mozilla Developers Remove Critical Bugs
The Mozilla Foundation has removed at least ten vulnerabilities from its browser, three of which were classified as critical by the developers.
One of the critical bugs gave attackers the ability to execute Javascript with chrome privileges. The bug report MFSA 2008-03 also mentions a vulnerability in the "XMLDocument.load" function which could be exploited to inject Javascript into a frame outside the original frame and thus work around the browser's same origin policy.
The Mozilla developers discovered various bugs in the Mozilla Browser Engine; although they are not described in more detail it is understood that they were capable of crashing the browser and thus giving attackers the ability to inject and execute malicious code. The bug described in MFSA 2008-01 also affects the Thunderbird mail client. The next version of Thunderbird will include a fix.
The third critical vulnerability, MFSA 2008-06, gave attackers the ability to parse the browser history via a "designMode" frame on a manipulated website. The attack could crash the browser thus giving attackers the ability to inject malicious code. MFSA 2008-10 desccribes another vulnerability caused by Javascript which allowed for URL hijacking using the "302 Redirect" function in HTML code.
The vulnerabilities described here can be avoided by temporarily disabling Javascript. The Mozilla Foundation's Security page describes these bugs and other security-relevant issues. Besides the Firefox browser, Seamonkey and Camino are affected. An updated version of Firefox (version 2.0.12) is available from the Mozilla servers. Distributors are likely to release updated packages in the next few days. Version 1.1.8 of the Seamonkey browser suite is also available for downloading.
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Endless OS 6 has Arrived
After more than a year since the last update, the latest release of Endless OS is now available for general usage.
-
Fedora Asahi 40 Remix Available for Macs with Apple Silicon
If you've been anticipating KDE's Plasma 6 for your Apple Silicon-powered Mac, then you're in luck.
-
Red Hat Adds New Deployment Option for Enterprise Linux Platforms
Red Hat has re-imagined enterprise Linux for an AI future with Image Mode.
-
OSJH and LPI Release 2024 Open Source Pros Job Survey Results
See what open source professionals look for in a new role.
-
Proton 9.0-1 Released to Improve Gaming with Steam
The latest release of Proton 9 adds several improvements and fixes an issue that has been problematic for Linux users.
-
So Long Neofetch and Thanks for the Info
Today is a day that every Linux user who enjoys bragging about their system(s) will mourn, as Neofetch has come to an end.
-
Ubuntu 24.04 Comes with a “Flaw"
If you're thinking you might want to upgrade from your current Ubuntu release to the latest, there's something you might want to consider before doing so.
-
Canonical Releases Ubuntu 24.04
After a brief pause because of the XZ vulnerability, Ubuntu 24.04 is now available for install.
-
Linux Servers Targeted by Akira Ransomware
A group of bad actors who have already extorted $42 million have their sights set on the Linux platform.
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.