Update your Firefox browser now, there's an emergency patch you'll want

[Eugene]

Source: The Verge

Update your Firefox browser now, there’s an emergency patch you’ll want

Hackers are actually exploiting this zero-day flaw, a researcher warns

By Sean Hollister Jun 18, 2019, 5:44pm EDT

Are you running Firefox version 67.0.3 or Firefox ESR 60.7.1? If the answer is “no,” or you’re not sure, maybe just update your web browser now. Firefox maker Mozilla is warning (via ZDNet) that the browser has a zero-day flaw that’s actively being exploited in the wild — you don’t see that every day — and it has issued an emergency patch that can let you plug that hole right now.

Here’s the full description of the issue:

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw.

Updating Firefox can be as easy as restarting the browser, though you can also tap the hamburger icon on the upper-right hand corner, type “Update” into the search box and hit that “Restart to update Firefox” button to be sure.

-snip-

Read more: https://www.theverge.com/2019/6/18/18684272/firefox-zero-day-flaw-browser-attacks-crypto-patch

______________________________________________________________________

Related:
• Mozilla Foundation Security Advisory 2019-18 (Mozilla)
• Mozilla patches Firefox zero-day abused in the wild (ZDNet)

[pnwest]

1. The hell does "in the wild" mean?

[Eugene]

2. It means real hackers are already using this exploit to do real-world damage.

It's not just a proof-of-concept done under laboratory conditions.

Per a separate advisory: a malware-infected website can inject arbitrary code into an unpatched version of Firefox without any user action beyond visiting the page.