Update Firefox now, because the Department of Homeland Security is telling you to
A recent release of Firefox had a bug severe enough, that the US government is telling everyone to update to guarantee online safety.
Mozilla Firefox
Mozilla has issued an update to its Firefox browser that fixes a critical security issue that could allow attackers to take control of affected computers. The issue has previously not been reported, but according to the Department of Homeland Security, it was already being exploited in attacks.
To update Firefox, users can open the browser, click on the Firefox menu, then on About Firefox. This will start the update.
Alternatively, users can visit the official site to download Firefox.
"Mozilla has released security updates to address a vulnerability in Firefox and Firefox ESR," wrote the US Department's Cyber-Infrastructure (CISA) division in a statement. "An attacker could exploit this vulnerability to take control of an affected system. This vulnerability was detected in exploits in the wild."
"[The CISA] encourages users and administrators to review the Mozilla Security Advisory for Firefox 72.0.1 and Firefox ESR 68.4.1 and apply the necessary updates," it concludes.
Choosing "About Firefox" will either start the update or, as here, show you when the latest one has been successfully installed
Firefox ESR is the version of the browser built for enterprise customers.
Mozilla's advisory for both this and the regular Firefox edition repeats the information that "we are aware of targeted attacks in the wild abusing this flaw."
In May 2019, Mozilla also required users to update Firefox following multiple failures with browser extensions.
Mozilla Firefox
Mozilla has issued an update to its Firefox browser that fixes a critical security issue that could allow attackers to take control of affected computers. The issue has previously not been reported, but according to the Department of Homeland Security, it was already being exploited in attacks.
To update Firefox, users can open the browser, click on the Firefox menu, then on About Firefox. This will start the update.
Alternatively, users can visit the official site to download Firefox.
"Mozilla has released security updates to address a vulnerability in Firefox and Firefox ESR," wrote the US Department's Cyber-Infrastructure (CISA) division in a statement. "An attacker could exploit this vulnerability to take control of an affected system. This vulnerability was detected in exploits in the wild."
"[The CISA] encourages users and administrators to review the Mozilla Security Advisory for Firefox 72.0.1 and Firefox ESR 68.4.1 and apply the necessary updates," it concludes.
Choosing "About Firefox" will either start the update or, as here, show you when the latest one has been successfully installed
Firefox ESR is the version of the browser built for enterprise customers.
Mozilla's advisory for both this and the regular Firefox edition repeats the information that "we are aware of targeted attacks in the wild abusing this flaw."
In May 2019, Mozilla also required users to update Firefox following multiple failures with browser extensions.
Comments
Maybe delete Firefox and switch to a different browser.
Apple has certainly had their share of critical bugs. How many years was Apple's "goto fail" bug present? Any captured SSL traffic could've been read which means for years your secure traffic was as good as plaintext for any person or agency that knew how to read it. That even includes after the fact for rooting through data dumps to peak at private information, which is why (for one) had to go change every password in my password manager after this bug was discovered and patched.
I don't remember ever seeing DHS actually make an announcement like this so especially in today's political environment I am a little suspicious about it. Firefox/Mozilla is open source so I wonder if someone slipped something in that DHS finally discovered. We've been told because of the assassination of General Qasem Soleimani to expect more cyber attacks so maybe this is the first one found. Who knows because there isn't any public information being given on this patch other than "CVE-2019-17026 is a type confusion vulnerability in IonMonkey, the JavaScript Just-In-Time (JIT) compiler for SpiderMonkey, Mozilla’s JavaScript engine. According to Mozilla’s advisory, the flaw exists in the JIT compiler due to “incorrect alias information for setting array elements,” specifically in StoreElementHole and FallibleStoreElement."
This is where it is officially identified, cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17026 There's nothing there to look at, however.
What browser do you switch to?
Chrome had a zero-day back in March and another in November
Safari had 2 back in March
...
FireFox updates pretty regularly on my laptop which is why I was surprised we had to do it manually. But, I don't use it very often on my MacBook (only when trying to sync with something on my laptop) so that may be why it was out of date there.
Indeed. Why else would DHS consider it so urgent to tell us to upgrade?