Risk: Medium
Mozilla has patched a vulnerability in its popular Firefox web browser that could allow hackers to snaffle information from the PCs of surfers. The JavaScript-related security bug, which affected versions 1.0.1 and 1.0.2 of Firefox, created a means for hackers to seize potentially sensitive information held in memory.
Exploitation of the flaw, discovered by Russian bug hunter Azafran, would be far from trivial. Nonetheless, vulnerability reports describe the heap buffer overflow bug as "moderately critical". A test has been designed by Internet Security Firm Secunia, allowing users to check whether they are vulnerable to the problem.
A potentially far more serious unpatched security vulnerability affects unspecified versions of Microsoft's Internet Explorer and Outlook software. The vulnerability "allows malicious code to be executed with minimal user interaction", warns security outfit eEye, which recently reported the bug to Microsoft.
A spokeswoman for Microsoft said it was investigating eEye's report.
"At this time, Microsoft is not aware of any malicious attacks attempting to exploit the reported vulnerabilities, and there is no customer impact based on this issue. Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a fix through a service pack, our monthly release process or an out-of-cycle security update, depending on customer needs," she said.