Firefox 3 exploit code in circulation

Stephen Withers
Friday, 27 March 2009 11:47

Business IT - Open Source

Exploit code attacking a security flaw in Firefox 3 has been made public. An update is expected next week.

The bug involves the way Firefox handles XSLT transformations of XML data. It apparently applies to all 3.0.x versions and to all platforms.

The proof of concept merely causes a crash, but there is a possibility that the memory corruption that occurs could be exploited to cause the execution of malicious code.

Guido Landi has been credited with the discovery of the bug.

Since an exploit has been made public, the release of Firefox 3.0.8 has become a high priority.

The revised code has already been frozen, and quality assurance work is in progress.

Firefox 3.0.8 is expected to be released sometime between Monday March 30 and Wednesday April 1. No April Fool's jokes, please.