Mozilla has patched two zero-day security vulnerabilities in Firefox that allowed backdoors to be installed on Macs, bypassing Apple's usual XProtect and Gatekeeper protections. Firefox users should update the browser immediately.
Ars Technica's Dan Goodin:
As noted by Mac security expert Patrick Wardle, XProtect and Gatekeeper provided no protection in this case, as they only scan applications that have a quarantine flag set. Fortunately, this may change in macOS Catalina.
Firefox users on Mac should update the web browser to version 67.0.4 as soon as possible to keep themselves protected.
More details can be read at Ars Technica.
Ars Technica's Dan Goodin:
Mozilla released an update on Tuesday that fixed a code-execution vulnerability in a JavaScript programming method known as Array.pop. On Thursday, Mozilla issued a second patch fixing a privilege-escalation flaw that allowed code to break out of a security sandbox that Firefox uses to prevent untrusted content from interacting with sensitive parts of a computer operating system.The zero-days were exploited by unnamed hackers this week, but so far, attacks are known only to have targeted Mac users involved in cryptocurrency.
3/ We’ve seen no evidence of exploitation targeting customers. We were not the only crypto org targeted in this campaign. We are working to notify other orgs we believe were also targeted. We’re also releasing a set of IOCs that orgs can use to evaluate their potential exposure.
— Philip Martin (@SecurityGuyPhil) June 19, 2019
As noted by Mac security expert Patrick Wardle, XProtect and Gatekeeper provided no protection in this case, as they only scan applications that have a quarantine flag set. Fortunately, this may change in macOS Catalina.
Firefox users on Mac should update the web browser to version 67.0.4 as soon as possible to keep themselves protected.
More details can be read at Ars Technica.
28 comments
Representatives for Apple and Microsoft will be participating in a meeting with the Carin Alliance that's focused on making it easier for patients to access and share their medical information,...
Apple today seeded the third beta of an upcoming macOS 10.15.3 update to developers for testing purposes, one week after seeding the second beta and more than a month after releasing the macOS...
Butter Royale has landed on the App Store as this week's addition to Apple Arcade across the iPhone, iPad, Apple TV, and Mac. The battle royale game is essentially a family-friendly version of...
On January 24, 1984, former Apple CEO Steve Jobs introduced the first Macintosh at Apple's annual shareholder's meeting in Cupertino, California, debuting the new computer equipped with a...
The Wall Street Journal today published a profile of Tony Blevins, Apple's vice president of procurement, providing an inside look at Apple's corporate culture and what Blevins does for the...
Apple today overhauled its Apple jobs website, introducing a new look and a new video in an effort to better recruit employees. The updated video on the site features the different Apple logo designs...
Apple is preparing to release a third season of its ongoing show "Carpool Karaoke: The Series," with the new trailer shared this morning on YouTube.
"Carpool Karaoke: The...
Apple today announced the launch of a new Apple Watch Connected program that should benefit both gyms and gym-goers.
The program will reward gym-goers for using an Apple Watch to track their...
