Kuleli sonto, ngomhlaka 19, iMozilla ikhiphe isibuyekezo esikhulu sesiphequluli sayo. Ezinsukwini ezimbalwa kamuva, inguqulo entsha yafinyelela ezinqolobaneni ezisemthethweni futhi namuhla, ezinsukwini ezimbili kamuva, inkampani isinayo ikhishwe iFirefox 66.0.1, inguqulo eza ukulungisa amaphutha amabili abucayi okuphepha lokho kwatholakala emncintiswaneni wokugenca iPwn2Own, lapho bezinikele ekutholeni nasekusebenziseni lezi zinhlobo zamaphutha, kodwa ngenxa yethu.
IFirefox 66.0.1 iyi- iyatholakala ngeWindows, Mac neLinux, kepha ayikatholakali njengephakethe ye-snap noma ezinqolobaneni ezisemthethweni. Uma kubhekwa ukuthi kuthathe isikhathi esingakanani ukuthi i-v66 ifike, singacabanga ukuthi i-v66.0.1 izotholakala ngoMsombuluko ozayo. Lokhu kungukuthi kungani amaphakheji we-snap noma amanye amaphakheji afanayo afana neFlatpak abaluleke kakhulu: yize iSitolo se-Snappy singaveli okwamanje, iphakethe le-snap lithola izibuyekezo nge-Push, okungukuthi, uhlelo olufanayo luyazithola ngokushesha lapho luvulwa.
IFirefox 66.0.1 iyeza maduze ezinqolobaneni ezisemthethweni
I-Los izimbungulu ezilungiswa yile nguqulo Ziyi-CVE-2019-9810 ne-CVE-2019-9813, zombili ezitholwe nguRichard Zhu, u-Amat Cama, noNiklas Baumstark ngeTrend Micro's Zero Day Initiative. Owokuqala kulaba ababili uchaza a Inkinga yokugcwala kakhulu kwe-buffer kanye nokwehluleka kokubheka umkhawulo engekho kuFirefox 66 ngenxa yemininingwane engafanele ye-alias ku-IonMonkey JIT compiler yendlela ye-Array.prototype.slice.
Ngakolunye uhlangothi, i-CVE-2019-9813 imayelana inkinga "yokuthayipha ukudideka" ku-IonMonkey JIT uqobo, kepha kulokhu ngekhodi. Le bug ingavumela umsebenzisi ononya ukuthi afunde futhi abhale imemori engafanele, eyayikhona (futhi isengenzeka ku-v66) ngenxa yokusetshenziswa kabi kwezinguquko ezingama-__proto__.
IMozilla ikhuthaza bonke abasebenzisi ukuthi bavuselele ngangokunokwenzeka. Njengoba sishilo phambilini, abasebenzisi beWindows nabakwaMacOS bazokwazi ukwenza kanjalo kusuka kwesexwayiso iFirefox ekhombisa lapho ukuvuselelwa kutholakala ngenxa yokuthi izibuyekezo ze-Push kade zaba khona kulezo zinhlelo. Abasebenzisi be-Linux bangakwazi landa inguqulo entsha futhi wenze ukufakwa okwenziwa ngesandla, kepha akusikho okunconyelwe kakhulu. Labo abasebenzisa iphakethe le-snap bazokwazi ukubuyekeza manje, kuyilapho thina esisebenzisa inguqulo ye-APT kuzodingeka silinde izinsuku ezimbalwa. Ake silinde ngaleso sikhathi.
