important notice to Firefox and Tor users : 0-day exploit

[labbe5]

https://nakedsecurity.sophos.com/2016/1 ... -455063009

Updated Firefox and Tor should be :

The version numbers you should see if you are up-to-date are:
• Firefox 50.0.2
• Firefox ESR 45.5.1
• Thunderbird 45.5.1
• Tor Browser 6.0.7 (based on Firefox ESR 45.5.1)

In old version of Firefox, drive-by installs could occur :

That malware could be ransomware, a keylogger, a password stealer, a zombie to blast out spam, a DDoS attack bot, or any of a number of money-making criminal tools.

[perdido]

Thanks for that.
It affects Windows, Linux, and Mac operating systems.

It also affects Pale Moon web browser. Pale Moon updated today to version 27.02
https://forum.palemoon.org/viewtopic.php?t=14018



.

[bark_bark_bark]

Thanks for that.
It affects Windows, Linux, and Mac operating systems.

It also affects Pale Moon web browser. Pale Moon updated today to version 27.02
https://forum.palemoon.org/viewtopic.php?t=14018



.

Actually it didn't affect PM if you actually read this announcement: https://forum.palemoon.org/viewtopic.ph ... ff640bd89b

[perdido]

Like your link says, it is extremely unlikely that it affects Pale Moon.

Then the author updated Pale Moon anyway and cited

Security fix:
Fixed a crash in SVG, related to CVE-2016-9079, as a defense-in-depth measure.

CVE-2016-9079 Link Here

Extremely unlikely is not an absolute.

It was extremely unlikely that Trump would win the election, too.

.

[TeX Dog]

Like your link says, it is extremely unlikely that it affects Pale Moon.

Then the author updated Pale Moon anyway and cited

Security fix:
Fixed a crash in SVG, related to CVE-2016-9079, as a defense-in-depth measure.

CVE-2016-9079 Link Here

Extremely unlikely is not an absolute.

It was extremely unlikely that Trump would win the election, too.

.

Yeah but most hackers and people in general do not become near forces of nature status that Trump either caused, lead, or foresaw or lasso-ed as it passed. I still do not know either, how so many including myself got it wrong.

[belham2]

Like your link says, it is extremely unlikely that it affects Pale Moon.

Then the author updated Pale Moon anyway and cited

Security fix:
Fixed a crash in SVG, related to CVE-2016-9079, as a defense-in-depth measure.

CVE-2016-9079 Link Here

Extremely unlikely is not an absolute.

It was extremely unlikely that Trump would win the election, too.

.

Yeah but most hackers and people in general do not become near forces of nature status that Trump either caused, lead, or foresaw or lasso-ed as it passed. I still do not know either, how so many including myself got it wrong.

{...whack to the forehead!...}

Of course, that's it, I've been wondering and searching for weeks now what happened. Trump is/was a walking-talking bioengineered "zero" day exploit on the collective U.S DNA. 'Splains everythin now


[edit: spelling of forhead--->forehead]

[8Geee]

I would try this on any Firefox browser or derivative.

1.) Disconnect from internet
2.) open FF or derivative browser
3.) in address bar type about:config, click OK
4.) in the search bar type svg
5.) double-click any heading that allows svg to make "false"
6.) Also make sure that "disable svg" types of headers are set to true
7.) In search bar type image
8.) the heading "image.http.accept" must be altered to
image/png,image/jpg,image/jpeg,image/gif;q=0.8,*/*;q=0.5
9.) Close browser, wait 10-20 seconds and open again
a.) if "already running" hang-up present, then restart X
10.) when open, close again after 10-20 seconds
11.) reconnect to internet

EDITED for new step #8 as firefox by default allows any type of image. By specifying these types of images, SVG is not listed as "accept".

HTH 4Now
8Geee

[souleau]

But SVG's are really nothing more than XML code, right?!

So, like, is this memory block allocation a specific function that only gets to be performed when it concerns SVG, or does this also occur with other XML objects?

In other words, is this an SVG problem, or an XML problem?

[belham2]

But SVG's are really nothing more than XML code, right?!

So, like, is this memory block allocation a specific function that only gets to be performed when it concerns SVG, or does this also occur with other XML objects?

In other words, is this an SVG problem, or an XML problem?

souleau,

Unfortunately (for all of us), you asked and answered the question. It is an XML problem.....which I think you know what that means

[Burn_IT]

"Extremely unlikely" does not work once a bug is known.
It may have been unlikely to have happened by chance, but once it has been published all sorts of "kiddies" will be playing with it.