Feeds

Browser bugs sprout eternal

Fresh vulns for Firefox and IE

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Mozilla has patched a vulnerability in its popular Firefox web browser that could allow hackers to snaffle information from the PCs of surfers. The JavaScript-related security bug, which affected versions 1.0.1 and 1.0.2 of Firefox, created a means for hackers to seize potentially sensitive information in memory.

Exploitation of the flaw, discovered by Russian bug hunter Azafran, would be far from trivial. Nonetheless security firm Secunia describes the heap buffer overflow bug as "moderately critical". It has put together a test allowing users to check whether they are exposed to the problem. Secunia advised users to disable JavaScript support as a precaution. According to a posting on Bugzilla, Mozilla has fixed the flaw. Security conscious surfers are advised to download this update.

A potentially far more serious unpatched security vulnerability affects unspecified versions of Microsoft’s Internet Explorer and Outlook software. The vulnerability "allows malicious code to be executed with minimal user interaction", warns security outfit eEye, which recently reported the bug to Microsoft.

A spokeswoman for Microsoft said it was investigating eEye's report.

"At this time, Microsoft is not aware of any malicious attacks attempting to exploit the reported vulnerabilities, and there is no customer impact based on this issue. Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a fix through a service pack, our monthly release process or an out-of-cycle security update, depending on customer needs," she said. ®

Related stories

Drive-by Trojans exploit browser flaws
Firefox dusted down with security upgrade
Exploit code attacks unpatched IE bug

Internet Security Threat Report 2014

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.