Firefox zero-day fix coming next week

Stephen Withers
Monday, 22 March 2010 09:44

Business IT - Open Source

The fix for a remotely exploitable security vulnerability in Firefox 3.6 has been developed but probably will not be released for another week.

In February, Secunia listed what it described as a "highly critical" vulnerability in Firefox 3.6. The vulnerability was reported by Evgeny Legerov, described by Secunia as "a researcher with a solid track record when it comes to finding vulnerabilities" and "a credible source".

Unfortunately for Firefox users, Legerov initially chose not provide Mozilla with details of the problem.

For an unknown reason, he subsequently hanged his mind, and Mozilla developers confirmed that the flaw could allow remote code execution without user interaction.

The flaw has been fixed as part of Firefox 3.6.2, but that version is still undergoing testing and is scheduled to be released on March 30.

Earlier versions of Firefox (and related software such as Thunderbird and Seamonkey) are not affected. Nor are Firefox 3.6.2 release candidate 3, or Firefox 3.7 alpha 3 or later.

CONTINUED