Mozilla Closes Down Critical Security Holes
The Mozilla Foundation has just released Firefox version 2.0.0.10 which resolves three critical vulnerabilities – but new issues have already reared their ugly heads.
One of the most serious vulnerabilities concerned handling of .jar files. An error in the Jar protocol implementation allowed cross-site scripting attacks on filters and other safeguards to grab login information and other data. Another scenario describes attacks with carefully crafted archives. Redirects allowed attackers to exploit the vulnerability. The second error to have been removed was exploitable by setting the "window.location" to redirect HTTP headers and thus launch cross-site scripting attacks.
The third error originated from a memory management bug which attackers could exploit to crash the browser or execute malicious code on the victim’s system. These vulnerabilities also affect Mozilla Seamonkey, a new version of which (1.1.7) will become available in the next few days.
But shortly after version 2.0.0.10 of Firefox was released, the next crop of bugs was identified. US-based developer Kevin Han has reported a bug that prevents the browser from displaying graphics embedded using Javascript. The new version responds to the "canvas.drawImage()" instruction with an error message of "NS_ERROR_NOT_AVAILABLE"; instead of displaying vector graphics, the method now draws pixel images in them.
Despite the new bug, the Firefox developers still advise users to update to the new version of the browser. The Mozilla Foundation servers have versions in various languages with distribution packages due to follow in the next few days.
Issue 224/2019
Buy this issue as a PDF
News
-
Chromium-Based Browsers Will Ignore Google’s Ad-Blocking Ban
Brave Opera and Vivaldi will not implement Google’s changes that will cripple ad-blockers.
-
Zorin OS 15 Released
The new release is based on Ubuntu 18.04 LTS.
-
Ubuntu to Package Proprietary Nvidia Driver
Canonical is making it easier for users to install proprietary Nvidia drivers.
-
openSUSE Leap 15.1 Released
Better hardware support.
-
Red Hat Enterprise Linux 8 Available
An OS redesigned for the hybrid cloud era.
-
Google Brings Linux to Chromebook
All new Chromebooks will be capable of running Linux.
-
Fedora Project Announces Fedora 30
The latest version comes with new tools and a new alignment of the various Fedora editions.
-
The Apache Software Foundation Completes Migration To GitHub
The foundation has decommissioned its own Git service.
-
Canonical Combines its Services in a Single Package
Now customers can gain access to all of its services under Ubuntu Advantage offering.
-
Black Hole Image Has an Open Source Connection
Two imaging libraries responsible for the image are fully open source.