81–90 of 111 posts
Took me a good while to find out how to check my version and update, as that functionality has moved around in the UI.
"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw." I'm at a loss imagining how this might work, can anyone expound on this? How might this actually occur?
One of the most obvious attacks is if two different typed objects have similar memory layouts you can use it to read/write fields. Say you had class A and class B and they are confused with each other. Suppose they have the following layout: struct A { int x void *f() } struct B { int x int y int z } Then if you have a class A and you make the program think it's actually class B. You can imagine that if you control a…
but won't the memory protection (write xor execute) stop the function pointer from jumping to the array body (since that's write memory)? Meh, i guess in actual practise, it's much more complicated than that...
Earlier quoted context omitted.
One of the most obvious attacks is if two different typed objects have similar memory layouts you can use it to read/write fields. Say you had class A and class B and they are confused with each other. Suppose they have the following layout: struct A { int x void *f() } struct B { int x int y int z } Then if you have a class A and you make the program think it's actually class B. You can imagine that if you control a…
> indexing the array you can have unrestricted read/write access to a large section of memory. but won't the memory protection (write xor execute) stop the function pointer from jumping to the array body (since that's write memory)? Meh, i guess in actual practise, it's much more complicated than that...
Firefox is supposed to have sandboxing, right? Does this sandboxing help against such attacks? As in: is there a second attack on the sandbox needed to get RCE?
It's in moments like this where I really dislike running Ubuntu and having to wait for the new build to be released.
It's a JIT bug, you can see the fix here: https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2...
simple code best code, the less opportunity you give people to shoot themselves in the foot the better
Took me a good while to find out how to check my version and update, as that functionality has moved around in the UI.
If anybody else is hunting for this: Hamburger menu -> Help -> About Firefox Your version number is listed under the big heading, and if there’s an update available there should be a button next to that. My question, I'm on beta channel and updated to 68.0b11 today and don't see detailed release notes. 67.0.3 (normal channel) lists "Security fix" https://www.mozilla.org/en-US/firefox/67.0.3/releasenotes/ But beta cha…
It's in moments like this where I really dislike running Ubuntu and having to wait for the new build to be released.
$ snap info firefox ... channels: stable: 67.0.3-1 2019-06-18 (230) 221MB - It is already available to use.
https://bugzilla.mozilla.org/show_bug.cgi?id=1544386 I find it really gross that they do not allow others to access it. This behavior damages the forks.