Firefox bugs set off fire alarms

 

Gallery

By Barry Collins

Posted on 27 Mar 2009 at 07:22

Mozilla is rushing out a patch for Firefox to address two "fire-drill" vulnerabilites in the browser.

The malicious code-execution bugs were made public over the past couple of weeks, and "can be exploited by tricking a user into visiting a malicious web page hosting the exploit code," according to Mozilla's blog.

Mozilla says it already has fixes in place for the Pwn2Own Exploit and XSL Transform vulnerability, and is in the process of testing the patch. The organisation describes the patch as "high-priority fire-drill security update".

The patch is scheduled to be released to the public on either 31 March or 1 April.

The security setback comes as Mozilla struggles to get the latest version of the Firefox browser out of the door. The newly-renamed Firefox 3.5 update has been pushed back two or three months following difficulties with the new Javascript engine, TraceMonkey.

The delay comes at a bad time for Mozilla, with new versions of Internet Explorer and Safari being launched in the past month, and Google releasing a new beta version of its Chrome browser.