Mozilla Says Flaw Could Lead to Data Leak
630854
Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.
149856
InfoWorld - Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.
721339
(InfoWorld) - The security team at Mozilla Corp. is looking into a flaw in its Firefox Web browser that hackers exposed at a conference in San Diego over the weekend. In a presentation at theÂ ToorCon hacker conference on Saturday, hackers Mischa Spiegelmock and Andrew Wbeelsoi demonstrated exploit code for a vulnerability in the way Firefox handles Javascript. On Monday, Mozilla said it was busy investigating the flaw, and did not offer any security researchers for comment because, according to spokeswoman Mary Colvig, they were all "heads down" on the problem. The company also said it will patch the flaw if it deems that action necessary. The vulnerability could allow someone to execute a memory corruption attack on Firefox if a user browsed to a Web site that contained the exploit code, said Ken Dunham, director of the rapid response team at security services company iDefense, a VeriSign company. "If you were to go to a Web site that contained the exploit code, it would fill up the available memory on the computer," he said. This would create an environment in which an attacker could take over the computer to do something harmful, he added. Dunham said that iDefense labs tested the exploit code, and it was "unreliable" and crashed the Firefox browser. Because of this, he does not consider the exploit to be a critical threat to Firefox. However, "someone could make some changes to the exploit code and make it more reliable," Dunham said. He added that there are other, more critical unpatched flaws in both Firefox and Microsoft Corp.'s Internet Explorer browser that are currently under attack by hackers.
684547
Microsoft and Mozilla reps add to the browser blame game, each saying the other's application is responsible for multiple Windows zero-day vulnerabilities.
638921
Security firm Secunia has issued an advisory regarding a newly discovered "highly critical" security flaw in Firefox 2.0 and later, which involves a special URI handler. Although the problem was initially attributed to Internet Explorer by researcher Thor Larholm, Firefox is the culprit.
281798
Before the sun set on Microsoft&#39;s Patch Tuesday this month, security firm Secunia discovered a vulnerability in Firefox that malicious hackers could exploit to compromise a user&#39;s system. Here&#39;s the catch: Exploiting the bug depends on interaction between Mozilla&#39;s browser and Microsoft&#39;s Internet Explorer.
189807
Browser flaw may leave you vulnerable to phishing attacks.
171139
A security firm has warned of a vulnerability in Safari that allows hackers to hijack confidential data entered into Web sites. Secunia says the flaws affect Safari, Mozilla and Firefox, Opera
681769
With the release of its latest Firefox 2.0.0.5 browser, open-source software maker Mozilla claims to have fixed a number of potentially serious vulnerabilities in its flagship product.
731042
Just one day after discovering Google's Firefox toolbar could be exploited in an attack, a similar flaw has been discovered in Google Desktop.
411868
A flaw in the way the Firefox and Opera browsers handle an image file could allow an attacker to see what Web sites a person has visited.The problem concerns how the two browsers handle a &quot;.BMP,&quot; or bitmap, image file, according to an advisory written by Gynvael Coldwind of Vexillium.org, who posted a video illustrating the problem.A malicious bitmap file can be created that pulls other information from the browsers&#39; memory. Some of the information that can be captured is random, but at other times could be valuable, the advisory said.&quot;The harvested data contains various information including parts of other Web sites, users&#39; favorites and history, and other information,&quot; Vexillium.org said.Using the &quot;canvas&quot; HTML (Hypertext Markup Language) tag supported by the browsers, an attacker can capture the data. Then, using JavaScript, the information can be sent to a remote server.The flaw could also crash Firefox. The vulnerability affects Firefox 2.0.0.11 and previous versions of that browser as well as the beta version of Opera 9.50.
290051
Google is Mozilla's sugar daddy.  Is this cause for alarm?
607294
Recently disclosed security holes that affect Internet Explorer 7 and Firefox could let attackers grab data via malicious Web sites.
751335
(InfoWorld) - Mozilla's security chief Tuesday panned a pair of Firefox bugs revealed Monday as low-level threats but hours later changed her mind and said that when used together, they could pose a greater risk. The researcher who disclosed the vulnerabilities agreed with her. Mostly. Michael Zalewski, who regularly publishes browser flaw findings, on Monday posted details on the Full-disclosure mailing list about four browser vulnerabilities, including two affecting Firefox. He categorized one as a "major" threat, and he saw the other as only a "medium" threat. In an entry on the Mozilla security blog -- which debuted last week -- Window Snyder, the company's chief security officer, said the more serious of the two bugs found by Zalewski was no more than a spoofing vulnerability and deserved only a "low" rating. "This is unsafe because it could be used to lure a user to enter content into the spoofed frame but does not result in code execution," said Snyder. "[For example] this might be used with phishing attacks." Her take doesn't jibe with Zalewski's contention that the flaw can be used to stick malicious code onto the victimized computer. "By my book, [this is] more serious than just spoofing, so I marked it as 'major,' whereas Mozilla still considers it to be a typical case of spoofing ('low')," said Zalewski in an e-mail interview Wednesday. "But it would be inaccurate to say that Window's assessment contradicts my analysis." Later Tuesday, Snyder updated her blog, saying that after further review, "these two bugs may be used together to allow an attacker to access any file the user has access to on the system. If this is the case, that may change the severity rating to 'medium'." Zalewski dismissed the idea that he and Mozilla's Snyder were at odds and instead turned attention to what he thinks is most important. "All in all, I think we pretty much agree here," he said. "The big issue [of the four vulnerabilities] was the Microsoft Internet Explorer flaw. The other three are important, but not critical." According to entries in Mozilla's Bugzilla, the more serious of the two Firefox flaws has not yet been assigned to someone for a fix. Snyder, meanwhile, said that the Mozilla security team is looking into changes to improve content handler management, the root cause of the bug she pegged as "low." Zalewski on Monday noted on the Full-disclosure mailing list that it appears Apple's Safari browser is also vulnerable to same bug he found in IE6 and IE7 and labeled "critical." Tuesday, Kevin Finisterre, a researcher known for the "Month of Apple Bugs" project in January, confirmed Zalewski's Safari suspicions. Apple officials did not reply to a request for comment.
94093
An intruder could manipulate a flaw in how the browsers handle image files to see where the user has been surfing.
424227
While Microsoft's Internet Explorer has become the bane of computer security, switching to Mozilla may not be the simple answer after all. Security firm Secunia has issued a "highly critical" advisory that details 10 separate vulnerabilities found in Mozilla, Firefox and Thunderbird. The flaws can be exploited remotely, allowing an attacker to compromise a system and expose sensitive data. Mozilla users are urged to upgrade to the latest releases of each application, which contain the necessary fixes.
519764
Cure worse than disease The Mozilla Foundation has patched a faulty patch that was itself subject to a security vulnerability.â¦