Highly Critical Security Hole in Firefox 3.5 - need immediate action

‘Highly Critical’ Security Issue in Firefox 3.5

According to Vulnerability note VU#443060 issued by US-CERT (United States Computer Emergency Readiness Team, Mozilla Firefox 3.5 contains a Highly Critical Security Hole that allows hackers to execute malicious code.

Mozilla is already aware of this Critical Issue and stated that “This is a JS engine bug dealing with deep bailing not properly restoring the return value from the result of the (fast native) escape function. We then try to do something with the uninitialized memory and crash in the interpreter.” and advices to disable JIT in the Javascript engine which will decrease Javascript performance. To disable the vunerable componen Type in about:config in the browser’s location bar, type jit in the filter box, and double-click the linke containing javascript.options.jit.content and set value to false.

The later Firefox 3.0 version is not affected because it doesn’t have support JIT (just-in-time) engine, this means I’m safe, I didn’t upgrade to 3.5 since I’m using a lot of firefox-plugins and some could not yet be supported. So until this highly critical issue is solved I’m stucked with Firefox 3.0.

via Mozilla Security Blog

Popularity: 2% [?]