Security Vulnerability in Firefox 16

Update (Oct 11, 2012)
  • An update to Firefox for Windows, Mac and Linux was released at 12pm PT on Oct 11. Users will be automatically updated and new downloads via http://www.mozilla.org/firefox/new/ will receive the updated version (16.0.1).
  • A fix for the Android version of Firefox was released at 9pm PT on Oct 10.
Issue:
Mozilla is aware of a security vulnerability in the current release version of Firefox (version 16). We are actively working on a fix and plan to ship updates tomorrow. Firefox version 15 is unaffected.

 

Impact:
The vulnerability could allow a malicious site to potentially determine which websites users have visited and have access to the URL or URL parameters.  At this time we have no indication that this vulnerability is currently being exploited in the wild.

 

Status:
Firefox 16 has been temporarily removed from the current installer page and users will automatically be upgraded to the new version as soon as it becomes available.  As a precaution, users can downgrade to version 15.0.1 by following these instructions [http://www.mozilla.org/firefox/new/].  Alternatively, users can wait until our patches are issued and automatically applied to address the vulnerability.

 

Michael Coates
Director of Security Assurance

155 responses

  1. Scott wrote on :

    “As a precaution, users can downgrade to version 15.0.1 by following these instructions [http://www.mozilla.org/firefox/new/]. ”

    Of course, when you go to that link, there are no instructions, but rather a link download the faulty 16.0.1. Smooth move.

  2. Another Pissed Off User wrote on :

    Who is that mastermind chief programmer of firefox?

  3. Another Pissed Off User wrote on :

    Who is that firefox mastermind chief programmer?
    Hand out Email Adress and Telefone Number!

  4. Bart Benus wrote on :

    So Mozilla developers are less than perfect. This is shocking news indeed: I was told they were Super Humans from outer space, that never make a single mistake, not ever! Thanks, you people at Mozilla, for all your honesty and excellent work: I will not even consider using anything else.

  5. john o neill wrote on :

    hi,
    when i right click on a webpage to send a link it is no letting me do this any suggestions or comments please?

    1. Jesse Ruderman wrote on :

      You can send a link to the page from the File menu (or Firefox menu on Windows). See https://bugzilla.mozilla.org/show_bug.cgi?id=786185 and https://bugzilla.mozilla.org/show_bug.cgi?id=239307

  6. Security Code is blank, no image wrote on :

    Security Code is blank, no image

  7. Security Code is still blank, still no image wrote on :

    Security Code is still blank, still no image

  8. Firefox Fanatic wrote on :

    Firefox is so cool! Go Vixens!

  9. Cylon wrote on :

    Hi
    from one night to the next morning, my Firefox 16.0.1. has stopped working. Other browsers do work,but not firefox. I made no changes in my firewall, nothing.
    I have uninstalled Firefox and reinstalled it again, but doesn’t work

    Can anyone gie me any solution?, Thanks

  10. Markus wrote on :

    How can I downgrade to Thunderbirg version 15?

  11. josh wrote on :

    why is the 16.0 version still supplied for Andoid?
    The 16.0.1 version is already days available. Please supply it to the Google Play Store.
    Now every day I get a reminder to upgrade my 15 version to 16.0, the one with security bug that I don’t want.
    Please withdraw the buggy version or supply the patched one.

    1. mcoates wrote on :

      The android version was patched and released at 9pm PT on Oct 10. You’ll see that it is version 16.0.1

      https://play.google.com/store/apps/details?id=org.mozilla.firefox

  12. Jonau wrote on :

    Firefox used to be a great product and secured ( relatively ).
    Today Firefox is worst than Microsoft product.
    I will definitely switch to another web browser.
    Every good thing has an end and this is an end of Fire Fox.

    1. pieroxy wrote on :

      Just out of curiosity, what exactly do you find worse in Firefox than in Microsoft?

      To me, if anything, this little thing proved that Mozilla is *super fast* in releasing patches for security vulnerabilities. Much more so than Microsoft is.

      1. TubeLugs wrote on :

        Umm, “super fast” as in “security patches break other things because they are insufficiently tested”?

  13. Mase wrote on :

    I was unlucky enough to have downloaded the update while making an online purchase. Now I am certain my CC has been compromised. Have been tracking certain items on my wish list suddenly they were available for unbelievable prices. It was only AFTER “purchasing” these items that I realized that the browser may have been compromised. So now I am with Aron, I have permanently turned off auto updates and I may never use FF the same way again. Will still use it to browse, but never for anything serious. Thought this kind of thing only was supposed to happen to IE users.

    1. Daniel Veditz wrote on :

      Mase: any troubles you’re having are nothing to do with the security flaw described here.

      1. while you can download updates while browsing, you have to restart Firefox to apply the update. There’s no way anything could change in the middle of a purchase.
      2. the flaw described in this article only leaked the address (http://etc) of the page you were visiting. Your CC number is never in the URL, you enter it into a form and post back to the server.

      Were you “tracking” the items using a wish-list feature of the on-line store? The store obviously knows that information and may be trying to entice you. Were you “tracking” them by repeatedly visiting them on a store site? The store knows that, too (unless you use private browsing and don’t log into your store account), and could be trying to entice you. Nothing to do with this flaw.

      Do you visit http://www.mozilla.org/plugincheck regularly to make sure your 3rd party plugins are up to date? If not, and especially if you have Java installed, then you may well be compromised — but not through Firefox itself. See the next article in this blog, “Click-to-Play Plugins, Blocklist-Style”, for our plans for dealing with that issue.

      1. Mase wrote on :

        Impact:
        The vulnerability could allow a malicious site to potentially determine which websites users have visited and have access to the URL or URL parameters.

        This is exactly what happened to me. I’ve made dozens of purchases from this very reputable site for years with absolutely zero problems. Then on 10/12, a few items suddenly dropped in price. Not once, not twice but on at least a DOZEN different unrelated items. All from the exact same seller whom I had never previously heard of in my 7-10 years of making purchases. At the time, I could not believe that all these items had suddenly become available and VERY affordable. It seemed almost too good to be true. Thinking it was safe to try I purchased one of the items. Afterward, I noticed my FF browser was acting a little wonky. I logged out of the site and closed the browser like I always do. Still feeling a little suspicious, I ran all my protection software (anti-virus, spyware, anti-trojan, rootkit, etc all in safe mode then again in regular mode). Everything ran with zero detections so I relaxed a bit. It was only after trying to open FF later that I got alerts from my firewall that FIREFOX browser was trying to access something in connection with explorer.exe. Now I am pretty certain after reading the IMPACT provided here that the sites URL may have been accessed since I visit the site and search for items almost every day (but don’t log on). It has all the feelings of a phishing site. But I am no expert. I only know it’s not feeling right. So after running all that software again (for safe keeping), I decided to go back to a previous date before the update. Which brings me to this page. End of story.

        1. Daniel Veditz wrote on :

          “Now I am pretty certain after reading the IMPACT provided here that the sites URL may have been accessed”

          That’s not how this flaw works. A malicious site can only read the URL you browse in a frame inside that site (which could visually be the whole tab, but the URL at the top would remain the attacking domain) or if the malicious site opens a new window or tab and you then browse in that. It cannot read arbitrary URLs out of your history or from windows unrelated to the malicious site.

          “I got alerts from my firewall that FIREFOX browser was trying to access something in connection with explorer.exe”

          This flaw most definitely can’t do THAT.

          You may have ad-ware installed that’s either too new to be detected or skirts the legitimacy line enough (“informed consent” in the form of a buried opt-out checkbox in an install) that they’re afraid to call it malware because they could get sued.

      2. Mase wrote on :

        btw, you certainly can update the browser in the middle of a purchase. All you have to do is HELP tab and select ABOUT FIREFOX in the drop down menu. Once you do this FF will search for, download and then INSTALL the update all without closing the window. Then you will have to restart FF for the update to take place.

        1. hillbilleter wrote on :

          Mase, what you have done is NOT to update in the middle of a purchase, by your own description. Your own statement, “Then you will have to restart FF for the update to take place” proves that all you have done is a simple download, not an installation. And the website that is worrying you may have improved its cookie placement procedures and put cookies in your browser to follow your habits. That’s what they do. Amazon comes to mind. After that, when you browse anywhere that allows those cookies to “talk” with a site that allows ads, the ads are trying to sell you things you’ve shown an interest in before. If you want to get ride of your cookies to test it, that may set your mind at ease.

  14. Rafael wrote on :

    como voltar se o programa faz a atualização automatica, vcs deveriam ver esses erros antes de mandar o upgrad do navegador

  15. Raj wrote on :

    Kaspersky Internet Security 2013’s Safe Money feature doesnt work on Firefox 16.0.1
    Now im not starting a debate on how good or bad Kaspersky is, but point is its a popular anti-virus app and the fact that it doesnt work with the new Firefox makes people jittery. My organisation uses Kaspersky on all the machines and since the amount of online transaction wen do is large, we are forced to use Internet Explorer and i hate it…. so who looks into this??

  16. João Dantas wrote on :

    I couldn’t login to this bank site since the Firefox 14.0 because of non compatibility with the security plugin. With the 16.01 version things went worse, and now Firefox crashes before it can open this page (Banco do Brasil).

  17. Matthew Atkinson wrote on :

    When you issue these releases, please give times that everyone can understand.

    ’12pm PT on Oct 11′ requires me to go and look up what ‘PT’ means. Wikipedia’s entry for PT has loads of entries, but none of them are for a timezone.

    Can you either give the time in UTC, which everyone knows how they relate to, or at the very least explain what the offset between PT and UTC is?

    1. David wrote on :

      http://en.wikipedia.org/wiki/Pacific_Time_Zone

  18. puru singh wrote on :

    Been in love with Firefox for a long time. Love everything ’bout it, specially its smooth scrolling prowess. Then this had to happen but fortunately upgraded as soon as the upgrade was available so its like ok. Only grudge is the Kaspersky compatibility issue. Tryin’ out v17.0.1 and Aurora at the moment.

  19. Aunty wrote on :

    I’m working on a second hand laptop and I’m not sure how much clear memory it has so I don’t want a stream of updates to clog it up. When I was offered the original version I read the small print and they made it clear it had little bugs so I opted not to update. The old one that everyone went back to was still working fine. If you do take the offer to be the first to try something you have to be prepared to encounter little glitches. You can report these bugs but you can’t really complain – especially if it’s free.

  20. Mystery Man wrote on :

    so much gaga on just one software? Give me a break!

More comments: 1 2 3 4 5