Feeds

Firefox fix lances memory corruption bug

Unload update stars in weekend patch release

High performance access to file storage

Firefox users need to update their browser software following the discovery of multiple vulnerabilities.

The flaws might be exploited to bypass security restrictions, conduct cross-site scripting or spoofing attacks, pinch sensitive information, or even gain control of vulnerable systems.

The flaws affect both the 1.5 and newer 2.0 releases of the popular open source browser. Users are advised to update to versions 2.0.0.2 or 1.5.0.10 to guard against attack. Users of the SeaMonkey also need to update to version 1.0.8 because of the same set of problems.

The most serious of the flaws fixed by the updates involves a failure to properly handle JavaScript onUnload events. This creates a risk of memory corruption in cases where a user is duped into visiting a maliciously-constructed website or viewing HTML in a hostile spam email, for example. The ruse, which might be used to trick a user into executing arbitrary code.

The Mozilla Foundation advises users to disable JavaScript as a workaround in cases where a new version of the browser can't be immediately installed.

An error in the Network Security Services (NSS) code involved in processing SSLv2 server messages might also be used to inject hostile code onto vulnerable systems running 1.5 versions of Firefox.

Mozilla isn't alone in having problems with onUnload coding, a feature security watchers have tagged as a security calamity waiting to happen for some time, the SANS Institute's Internet Storm Centre reports.

Internet Explorer 7's handling of "onunload" events might be exploited by a malicious website to spoof the address bar, security notification firm Secunia warns, in a vulnerability it describes as "less critical". ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.