CRITICAL 0-day active in the wild

Update FireFox ASAP

[iamlost]

If you are running the FireFox browser there is a CRITICAL 0-day active in the wild.
Please update as soon as practicable.

* Mozilla Foundation Security Advisory 2019-18 [mozilla.org]

Security vulnerabilities fixed in Firefox 67.0.3 and Firefox ESR 60.7.1

Announced: June 18, 2019
Impact: critical
Products: Firefox, Firefox ESR
Fixed in Firefox 67.0.3, Firefox ESR 60.7.1

CVE-2019-11707: Type confusion in Array.pop
Reporter: Samuel Groß of Google Project Zero, Coinbase Security
Impact: critical

Description: a type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw.

[tangor]

Side note: Also affects Thunderbird ...... so do both!

[tangor]

My bad! The t-bird was yesterday ... slightly different beast!

You are returned to your regularly scheduled programming.

[engine]

Thanks, that was a quick and easy update to fix.

[ken_b]

Thanks for the alert. Updated both, easy as could be.

[JS_Harris]

Reality: There are probably several "0-day in the wild" type exploits going on that are not yet known or discussed.

We are aware of targeted attacks in the wild abusing this flaw.

That right there is what I'd like to know more about, HOW would they be aware of other people's computers having been compromised without themselves having compromised, err... "monitored" said computers? Hackers today only need to know that back doors exist, find them, and exploit the access for themselves.

Truly secure would mean secure even from the good guys. Anyway, glad they still report some things, update, update!

[engine]

HOW would they be aware of other people's computers having been compromised

Could be the crash reporter?

[iamlost]

Good explanation [zdnet.com] of how the FF zero days (yes, apparently there were two used in series) were found in the wild: a spearphishing attack against crytocurrency employees.

[iamlost]

Mozilla has just issued another quick update [mozilla.org] labelled Impact: HIGH.
From the description below I think that this is the second of the chained 0-days mentioned above.

CVE-2019-11708: sandbox escape using Prompt:Open

Reporter: Coinbase Security
Impact: HIGH

Description: insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer.

[mcneely]

I think that this is the second of the chained 0-days mentioned above.

Oh great -- .03 just came down the repos "today" and now I gotta sit around and wait for the .04

[tangor]

June 23 ... I've had my THIRD FF update ... all "critical" ... so what the heck is going on?

[iamlost]

I've had my THIRD FF update ... all "critical" ... so what the heck is going on?

You're critical to the meaning of life, the universe, and everything?

[tangor]

Of course I am! :)

[KnowOneSpecial]

tangor says....
I've had my THIRD FF update ... all "critical" ... so what the heck is going on?

iamiost says...
You're critical to the meaning of life, the universe, and everything?

@tangor
The answer to your question is "42"

[tangor]

Perhaps ... 29 years ago.