Firefox 3.6.13 fixes multiple critical vulnerabilities

Stephen Withers
Monday, 13 December 2010 08:55

Business IT - Open Source

The latest version of Firefox fixes 11 vulnerabilities, most of them critical.

The popular Firefox browser was updated late last week to version 3.6.13. Other Mozilla products - Firefox 3.5, Thunderbird 3.0 and 3.1, and SeaMonkey 2 - also received updates.

Vulnerabilities fixed in Firefox include a number of memory safety bugs, buffer overflows, privilege escalations, OpenFont handling, a use-after-free error, and an integer overflow condition. These vulnerabilities potentially allow an attacker to run arbitrary code on the victim machine.

The update also addresses somewhat less serious flaws allowing location bar spoofing (making it appear that a page has been delivered by a site other than the actual source) and cross-site scripting (a set of techniques that work by introducing malicious content into normally trustworthy pages, for example through maliciously crafted URLs).

Windows and Mac OS X users can most conveniently install the latest version by using the program's Check for Updates command.

Firefox 4.0, a major revision to the browser, is expected sometime in early 2011.