Mozilla has patched two zero-day security vulnerabilities in Firefox that allowed backdoors to be installed on Macs, bypassing Apple's usual XProtect and Gatekeeper protections. Firefox users should update the browser immediately.
Ars Technica's Dan Goodin:
As noted by Mac security expert Patrick Wardle, XProtect and Gatekeeper provided no protection in this case, as they only scan applications that have a quarantine flag set. Fortunately, this may change in macOS Catalina.
Firefox users on Mac should update the web browser to version 67.0.4 as soon as possible to keep themselves protected.
More details can be read at Ars Technica.
Ars Technica's Dan Goodin:
Mozilla released an update on Tuesday that fixed a code-execution vulnerability in a JavaScript programming method known as Array.pop. On Thursday, Mozilla issued a second patch fixing a privilege-escalation flaw that allowed code to break out of a security sandbox that Firefox uses to prevent untrusted content from interacting with sensitive parts of a computer operating system.The zero-days were exploited by unnamed hackers this week, but so far, attacks are known only to have targeted Mac users involved in cryptocurrency.
3/ We’ve seen no evidence of exploitation targeting customers. We were not the only crypto org targeted in this campaign. We are working to notify other orgs we believe were also targeted. We’re also releasing a set of IOCs that orgs can use to evaluate their potential exposure.
— Philip Martin (@SecurityGuyPhil) June 19, 2019
As noted by Mac security expert Patrick Wardle, XProtect and Gatekeeper provided no protection in this case, as they only scan applications that have a quarantine flag set. Fortunately, this may change in macOS Catalina.
Firefox users on Mac should update the web browser to version 67.0.4 as soon as possible to keep themselves protected.
More details can be read at Ars Technica.
28 comments
In celebration of World Emoji Day tomorrow, Apple has shared details on new emoji that are coming to iOS devices this fall following the Unicode 12 emoji release.
Unicode 12 brings 59 new emoji...
Apple introduced updates to many of the built-in iOS apps in iOS 13, and Maps is no exception. The updated version of Maps has a long list of new features that are designed to make the Apple Maps app...
Apple has a plan to start funding original podcasts in order to better compete with Spotify, according to a new report from Bloomberg. Apple executives have been reaching out to media companies to...
Two of Apple's ads are in the running to receive the 2019 Outstanding Commercial Emmy. Both of the ads were created by TBWA/Media Arts Lab, Apple's longtime advertising partner.
The...
Apple today pushed a second silent security update to Macs to address further vulnerabilities related to the Zoom video conferencing app for macOS, reports The Verge.
Apple removed software that...
Apple today seeded the fourth beta of macOS 10.15 Catalina for testing purposes, two weeks after seeding the third macOS Catalina beta and over a month after the new Mac operating system update was...
Apple today seeded the seventh beta of an upcoming iOS 12.4 update to developers, one week after seeding the sixth iOS 12.4 beta, and two months after releasing iOS 12.3, a major update that...
To celebrate the 50th anniversary of the Apollo 11 moon landing, Apple this afternoon shared a new video featuring clips from its upcoming Apple TV+ show "For All Mankind" along with...
