Firefox 1.5.0.5 Fixes JavaScript Flaws No Fewer Than Seven Critical Flaws Patched in Browser Update Sean Michael Kerner
JavaScript (define) is the source of great power within the Mozilla Firefox browser. Unfortunately it may well also be the trigger for many of its flaws.
Today's release of Mozilla Firefox 1.5.0.5 is the latest official edition of the open source browser and patches no fewer than seven critical flaws, with some form of JavaScript issue being at the heart of most of them.
Mozilla Foundation Security Advisory 2006-44, entitled "Code execution through deleted frame reference," outlines one such highly critical JavaScript-related flaw.
In certain circumstances, according to the advisory, a JavaScript reference to a frame or window is not properly cleared when the referenced content went away.
The pointer to the deleted object could potentially be used to execute arbitrary code.
Security Advisory 2006-45, entitled " Javascript navigator Object Vulnerability," is another critical JavaScript-related flaw, which, if exploited, could allow an attacker to run arbitrary code.
Called "JavaScript engine vulnerabilities," the fix covers up additional places where an untimely garbage collection could delete a temporary object that was in active use. Some of these may allow an attacker to run arbitrary code given the right conditions.
At least one of the JavaScript-related flaws reported as part of the Firefox 1.5.0.5 release has its discovery credited to security researcher H.D Moore.
The critical Mozilla Foundation Security Advisory 2006-48, titled "JavaScript new Function race condition," addresses a vulnerability that could potentially result in arbitrary code execution.
Even some of the security advisories that don't have the term "JavaScript" in the title appear to be related to JavaScript in some way.
The critical Mozilla Foundation Security Advisory 2006-46, titled "Memory corruption with simultaneous events," is a case in point.
Though that particular advisory does not explicitly mention JavaScript in its description of the flaw, JavaScript is part of the solution for the flaw. The workaround, according to the Mozilla advisory, suggests that users Disable JavaScript until they can upgrade to a fixed version.
The 1.5.0.5 release is the fifth Firefox point release from Mozilla this year.
It released the Firefox 1.5.0.4 update at the beginning of June and corrected five critical vulnerabilities.
Mozilla's next-generation Mozilla Firefox 2.0 release is now in Beta 1, and is expected to go to full release in September.
