Mozilla released 10 security fixes for its Firefox browser Wednesday in advance of next week’s PWN2OWN contest at the CanSecWest conference in Vancouver, where security experts will attempt to exploit any security vulnerabilities in the world’s leading web browsers. Mozilla’s update follows on the heels of 19 security fixes that Google released for Chrome on Monday.
p
Hosted by security firm TippingPoint, the annual PWN2OWN event draws major media attention from around the globe. This year, Google is raising the stakes by offering a $20,000 cash prize to any PWN2OWN contestant who successfully breaches Chrome’s browser security.
p
Kudos to the Google security team for taking the initiative to approach us on this, said Aaron Portnoy, manager of the security research team at TippingPoint. We’re always in favor of rewarding security researchers for the work they too often do for free, he wrote in a blog.
p
subhead
A JPEG Exploit
/subhead
p
Mozilla’s first browser security update since Dec. 9 includes fixes for eight critical vulnerabilities. This week’s Firefox 3.6.14 update covers a range of vulnerability issues, many of which were reported to Mozilla by independent security researchers.
p
For example, Jordi Chancel notified Mozilla that hackers could potentially construct a JPEG file that some versions of Firefox would decode incorrectly, causing data to be written past the end of the buffer that the machine creates to store the image. An attacker could potentially have exploited this vulnerability by causing malicious code to be stored in memory for later execution on the host computer.
p
Adobe Systems security researcher Peleus Uhley reported a cross-site request forgery (CSRF) risk where unauthorized commands could be transmitted through a user that a web site trusts. When the requests initiated by a Firefox plug-in received a 307 redirect, the plug-in would not have been notified and the request could have been forwarded to another location…