Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mozilla First To Patch Pwn2Own Browser Vulnerability

Posted by Soulskill on from the comparatively-quick dept.

Constantine the Less writes "Mozilla has released Firefox 3.0.8 to fix a pair of code execution holes that put users of the browser at risk of drive-by download attacks. It includes a fix for one of the flaws exploited during this year's CanSecWest Pwn2Own hacker contest. The update also fixes a separate zero-day flaw disclosed earlier this week on a public exploit site. Both issues are rated 'critical,' Mozilla's highest severity rating."

3 of 141 comments (clear)

  1. Re:MS already patched in IE8 final build by Anonymous Coward · · Score: 5, Informative

    Doesn't support DEP, so will be a bit more work.

    DEP is supported on Windows XP since SP2.

  2. Re:And this is a surprise? by makomk · · Score: 5, Informative

    Well, it wouldn't work on Vista on the final release of IE8, except on Intranet pages. Apparently, it still works on IE8 running under XP, still works on Intranet pages. The underlying vulnerability is still present on IE8 on all platforms, it's just that there's not currently any way to exploit it thanks to DEP and ASLR.

  3. Re:And this is a surprise? by icebraining · · Score: 5, Informative

    On the other hand, Firefox on Linux wasn't exploited at all.

    --
    Dilbert RSS feed