Mozilla patches 9 Firefox bugs, adds plug-in crash protection

Ships delayed Firefox 3.6.4 with new feature that keeps Windows, Linux browsers running when Flash, QuickTime or Silverlight go south

Mozilla on Tuesday patched nine vulnerabilities, six of them critical, in Firefox 3.6 and Firefox 3.5.

But rather than highlighting the security fixes in Firefox 3.6.4, the company instead emphasized the addition of crash protection, a move meant to keep the browser alive when popular plug-ins drop dead.

Updates to Firefox 3.6.4 and Firefox 3.5.10 fixed nine flaws for each version, although the total patch count came to 10 because two fixes affected only one of the pair.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Mozilla on Tuesday patched nine vulnerabilities, six of them critical, in Firefox 3.6 and Firefox 3.5.

But rather than highlighting the security fixes in Firefox 3.6.4, the company instead emphasized the addition of crash protection, a move meant to keep the browser alive when popular plug-ins drop dead.

Updates to Firefox 3.6.4 and Firefox 3.5.10 fixed nine flaws for each version, although the total patch count came to 10 because two fixes affected only one of the pair.

Six of the nine vulnerabilities for each browser were rated "critical," Mozilla's highest threat ranking, indicating that hackers could use them to compromise a system running Firefox, then plant other malware on the machine.

Two were labeled "moderate," the second-lowest rating, while one was tagged as "low."

One of the critical flaws was reported to Mozilla by Nils, a German research who only goes by his first name.

Nils gained fame by winning cash prizes at the last two annual Pwn2Own hacking contests, sponsored by HP TippingPoint's Zero Day Initiative bug bounty program.

Last March, Nils took home $10,000 by sidestepping DEP (data execution prevention) and ASLR (address space layout randomization) in Windows 7 to exploit the then-current Firefox 3.6.2.

It was Nils' second Pwn2Own victory; last year he grabbed $15,000 by exploiting not only Firefox, but also Safari and IE8.

Mozilla also marked a clutch of bugs in the browser and JavaScript engines as critical, although it only assumed the flaws could be exploited.

"Some of these crashes showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code," Mozilla said, using boilerplate language it often inserts into browser or JavaScript engine security advisories.

But Mozilla wanted all eyes on Firefox 3.6.4 for a different reason. "Results from our beta testing show Firefox 3.6.4 will significantly reduce the number of Firefox crashes experienced by users who are watching online videos or playing games," said Christian Legnitto, who oversees the Firefox releases, in a post to Mozilla's blog .

"When a plug-in crashes or freezes while using Firefox, users can enjoy uninterrupted browsing by simply refreshing the page," he said.

Firefox 3.6.4 currently recovers only from crashes of Adobe's Flash Player, Apple 's QuickTime and Microsoft 's Silverlight plug-ins, and is available only in Firefox for Windows and Linux . The company is still working on the feature, which it has dubbed "out of process plug-ins," or OOPP, for the Mac version.

Mozilla has had an eye on Flash for OOPP treatment because Adobe's software has been responsible for more Firefox crashes than any other plug-in, according to the company.

It has also worked other features into Firefox to deal with problems in that plug-in, and others. Last year, for example, Mozilla kicked off plug-in checking , a feature that determines whether a user is running an outdated, and possibly vulnerable, plug-in, by focusing on Flash.