{"id":40026,"date":"2017-08-10T11:56:34","date_gmt":"2017-08-10T11:56:34","guid":{"rendered":"https:\/\/www.biphoo.com\/bipnews\/?p=40026"},"modified":"2017-08-10T11:59:20","modified_gmt":"2017-08-10T11:59:20","slug":"mozilla-fixes-29-vulnerabilities-in-firefox-makes-flash-click-to-activate","status":"publish","type":"post","link":"https:\/\/www.biphoo.com\/bipnews\/technology\/mozilla-fixes-29-vulnerabilities-in-firefox-makes-flash-click-to-activate.html","title":{"rendered":"MOZILLA FIXES 29 VULNERABILITIES IN FIREFOX, MAKES FLASH CLICK-TO-ACTIVATE"},"content":{"rendered":"<h2 style=\"text-align: justify\"><span style=\"font-size: 18pt\"><strong><span style=\"font-family: Arial, Helvetica, sans-serif;color: #000000\">MOZILLA FIXES 29 VULNERABILITIES IN FIREFOX, MAKES FLASH CLICK-TO-ACTIVATE<\/span><\/strong><\/span><\/h2>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">Mozilla fixed three critical vulnerabilities when it released Firefox 55 on Tuesday, including bugs that could have triggered a crash of the browser and allowed for the execution of arbitrary code.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">The code execution vulnerability stems from an XUL injection vulnerability due to improper sanitization of the web page source code. XUL, or XML User Interface Language, is Mozilla\u2019s language for building app interfaces. Frederik Braun, a Berlin-based security engineer for Mozilla who found the vulnerability, cautions the bug could allow for code execution if a user opened a malicious page with the browser\u2019s style editor developer tool.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">The other two critical bugs, use-after-free vulnerabilities, could have led to exploitable crashes.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">One could have occurred in the browser\u2019s WebSockets technology if \u201can object holding the connection is freed before the disconnection operation is finished.\u201d The second bug, uncovered by longtime bug hunter Nils, could have occurred while \u201cre-computing layout for a marquee element during window resizing where the updated style object is freed while still in use.\u201d<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">A handful of other issues, including four additional use-after-free vulnerabilities, a buffer overflow, and a same-origin bypass, all marked high severity, were also fixed on Tuesday. The bugs could be used to bypass memory protections, lead to information disclosure, or like the critical vulnerabilities, lead to a crash.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">Twenty-nine vulnerabilities in total were fixed with Firefox 55, the first iteration of the browser to turn on click-to-activate functionality for Flash by default.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">The move has been in the works for years. Mozilla first enabled click to play for virtually all plugins, except the latest release of Flash, back in 2013.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">Previous versions of Firefox gave users the option to disable Flash by default. By allowing Flash to run on demand, the browser would prompt users whether they wanted to activate the software upon navigating to a page that required it.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">The move comes a few weeks after Adobe announced that it would finally kill off Flash in 2020.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">Benjamin Smedberg, a senior engineering manager at Mozilla, said shortly after Adobe\u2019s announcement that Firefox was planning on disabling Flash by default in 2019. Firefox\u2019s Extended Support Release (ESR) version will allow users to continue using Flash until the end of 2020.<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-size: 14pt;font-family: Arial, Helvetica, sans-serif;color: #000000\">\u201cIn order to preserve user security, once Flash is no longer supported by Adobe security patches, no version of Firefox will load the plugin,\u201d Smedberg wrote.<\/span><\/p>\n<p><span style=\"font-size: 8pt\">Source:-=\u00a0https:\/\/threatpost.com\/mozilla-fixes-29-vulnerabilities-in-firefox-makes-flash-click-to-activate\/127338\/<\/span><\/p>\n<div class=\"fb-background-color\">\n\t\t\t  <div \n\t\t\t  \tclass = \"fb-comments\" \n\t\t\t  \tdata-href = \"https:\/\/www.biphoo.com\/bipnews\/technology\/mozilla-fixes-29-vulnerabilities-in-firefox-makes-flash-click-to-activate.html\"\n\t\t\t  \tdata-numposts = \"10\"\n\t\t\t  \tdata-lazy = \"true\"\n\t\t\t\tdata-colorscheme = \"light\"\n\t\t\t\tdata-order-by = \"social\"\n\t\t\t\tdata-mobile=true>\n\t\t\t  <\/div><\/div>\n\t\t  <style>\n\t\t    .fb-background-color {\n\t\t\t\tbackground: #ffffff !important;\n\t\t\t}\n\t\t\t.fb_iframe_widget_fluid_desktop iframe {\n\t\t\t    width: 630px !important;\n\t\t\t}\n\t\t  <\/style>\n\t\t  ","protected":false},"excerpt":{"rendered":"<p>MOZILLA FIXES 29 VULNERABILITIES IN FIREFOX, MAKES FLASH CLICK-TO-ACTIVATE Mozilla fixed three critical vulnerabilities when it released Firefox 55 on Tuesday, including bugs that could have triggered a crash of the browser and allowed for the execution of arbitrary code. The code execution vulnerability stems from an XUL injection vulnerability [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":40033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[42079,42078],"class_list":["post-40026","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-makes-flash-click-to-activate","tag-mozilla-fixes-29-vulnerabilities-in-firefox"],"_links":{"self":[{"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/posts\/40026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/comments?post=40026"}],"version-history":[{"count":0,"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/posts\/40026\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/media\/40033"}],"wp:attachment":[{"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/media?parent=40026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/categories?post=40026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.biphoo.com\/bipnews\/wp-json\/wp\/v2\/tags?post=40026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}