{"id":16825,"date":"2013-08-12T11:18:32","date_gmt":"2013-08-12T18:18:32","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=16825"},"modified":"2016-10-06T12:33:55","modified_gmt":"2016-10-06T19:33:55","slug":"firefox-23-brings-mixed-content-blocking-with-security-fixes","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/firefox-23-brings-mixed-content-blocking-with-security-fixes\/","title":{"rendered":"Firefox 23 Brings Mixed Content Blocking with Security Fixes"},"content":{"rendered":"

Last week, Mozilla released<\/a> Firefox 23 for Mac OS X, which included 13 fixes for known vulnerabilities (4 Critical, 7 High, 1 Moderate, 1 Low), and comes bundled with a new security feature called the Mixed Content Blocker. Among the critical issues resolved in this update were several memory safety bugs that, presumably, with enough effort could be exploited to run arbitrary code. All of the critical bugs fixed in Firefox 23 could cause a potentially exploitable crash.<\/p>\n

Multiple cross-site scripting (XSS) issues were fixed with Firefox 23. For instance, this update fixed a problem with an interaction of frames and browser history that made it possible for the browser to believe \u201cattacker-supplied content came from the location of a previous page in browser history,\u201d a high vulnerability that allows for cross-site scripting (XSS) attacks. For all versions of Firefox before 23, the vulnerabilities identified as \u201chigh\u201d can be used to gather sensitive data from other sites that a user is visiting or inject data or code into those sites.<\/p>\n

Following is a complete list of the security issues resolved in the Firefox 23 update:<\/p>\n