Mozilla's open source web browser Firefox has got a pair of serious vulnerabilities, it has emerged. This from Information Week:
"A pair of unpatched vulnerabilities in Mozilla's Firefox Web browser - rated as 'extremely critical' by one security firm - could allow an attacker to take control of a PC simply by getting a user to visit a malicious Web site, Mozilla said Sunday.
Because proof-of-concept code has been leaked - as were the vulnerabilities - before a patch was ready, Mozilla recommended that Firefox users either disable JavaScript or lock down the browser so it doesn't install additional software, such as extensions" or themes, from Web sites.
Mozilla's security center says that "there are currently no known active exploits of these vulnerabilities" but that the foundation is "aggressively working to provide a more comprehensive solution to these potential vulnerabilities". There's a further security advisory here.
Of course, this kind of vulnerability shouldn't really come as a surprise. All browsers have problems, though Firefox claimed to have fewer than its competition. The question is how quickly this can be solved, and whether it will be exploited in the interim. That's where open source says its strength is, and now it's time to prove it.
