208
Firefox 117.0.1 released (www.mozilla.org)
submitted 1 year ago by hal_5700X@lemmy.world to c/firefox@lemmy.ml
you are viewing a single comment's thread
view the rest of the comments
[-] lemann@lemmy.one 37 points 1 year ago

I guess this ships the fix for the webp zero-day? That was pretty quick of them, massive props ๐Ÿ‘Œ

[-] kubica@kbin.social 7 points 1 year ago

It was that, the link about the security fix is working now.

[-] hal_5700X@lemmy.world 4 points 1 year ago* (last edited 1 year ago)
[-] jsdz@lemmy.ml 4 points 1 year ago

If you're looking for the details of how it was fixed, you'd need to look elsewhere such as: https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/

[-] lustrum@sh.itjust.works 2 points 1 year ago* (last edited 1 year ago)

Anyone who knows things got a laymen explanation for this zeroday?

[-] DScratch@sh.itjust.works 3 points 1 year ago

In my understanding: What happens is a Heap Buffer Overflow. The Heap is a style of memory and a Buffer is just a chunk of storage where you place something that is a work in progress. (Think a Youtube video buffering, you are waiting for more data to come down so you can play the video)

The WebP image type has the unintended ability to write to more memory than the OS assigns it. It can 'overflow'.

If you craft a WebP image file just right, you can write malicious code to a location in memory that the OS may think is executable code and then run it, all without the user knowing.

this post was submitted on 12 Sep 2023
208 points (98.6% liked)

Firefox

17302 readers
215 users here now

A place to discuss the news and latest developments on the open-source browser Firefox

founded 4 years ago
MODERATORS