The Mozilla Foundation has released security updates to fix multiple flaws that could result in system hijacking in its open-source Firefox browser, Thunderbird e-mail client and SeaMonkey Internet applications suite.
The bugs, deemed critical, are detailed in Mozillas Security Advisory 2007-12. They include multiple vulnerabilities in Mozillas Layout Engine and in its JavaScript engine that can result in memory corruption and lead to system takeover or DoS (denial of service). The function of a layout engine is to handle content such as HTML, XML, image files and applets as well as formatting information including CSS (Cascading Style Sheets) and presentational HTML tags. The layout engine displays the formatted content on-screen, filling in the browsers content area.
/zimages/5/28571.gifFirefox users who dont install the ANI patch are in danger of files being overwritten in an attack, given that the browser lacks a low-privilege mode.Click hereto read more.
According to Mozillas advisory, the impacts of the vulnerabilities vary. “Some of these crashes that showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code,” the advisory says.
Mozilla fixed the Layout Engine bugs in these updates: Firefox Versions 2.0.0.4 and 1.5.0.12; Thunderbird Versions 2.0.0.4 and 1.5.0.12; and SeaMonkey Versions 1.0.9 and 1.1.2. The downloads are available at the advisory site.
Mozilla points out that Thunderbird shares Firefoxs browser engine, which could make it vulnerable if JavaScript is enabled in mail. The Foundation says that this isnt the default setting and strongly urges users not to run JavaScript in mail. “Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript, such as large images,” Mozilla says.
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.