Mozilla Highly Critical Vulnerability

[TCH-Thomas]

Secunia (http://secunia.com/advisories/13687/)writes

Maurycy Prodeus has reported a vulnerability in Mozilla, which potentially can be exploited by malicious people to compromise a user's system.

 

The vulnerability is caused due to a boundary error in the "MSG_UnEscapeSearchUrl()" function in "nsNNTPProtocol.cpp" when processing NNTP URIs. This can be exploited via e.g. a malicious web site to cause a heap-based buffer overflow when referencing a specially crafted, overly long "news://" URI.

 

Successful exploitation may allow execution of arbitrary code.

 

The vulnerability has been reported in version 1.7.3 and prior.

 

Solution:

Update to version 1.7.5.

 

Please note: This affects Mozilla not Firefox as far as I can tell.

[borfast]

Thanks, Thomas!

[Madmanmcp]

Thanks Thomas, you beat me to it

[TCH-Thomas]

Well, we can not only nag about I.E´s vulnerabilities.

[Madmanmcp]

LOL

 

well we probably could...

[Sheila]

Thanks Thomas - Mozilla is one of the browsers I use to test my designs, so I'd rather not be open to hackers while I do!! Downloading the latest version even as I type

[Deverill]

Well, we can not only nag about I.E´s vulnerabilities.

<{POST_SNAPBACK}>

The funny thing is, how many times is the solution to an IE vulnerability to "use the latest version"?

[borfast]

I find it strange that Mozilla still didn't say anything about this... :|