3 ms·

So this is about how someone hacked Bugzilla, extracted sensitive information about a vulnerability in Firefox' PDF engine, wrote a weaponized exploit for it, d

by 0x0 11y ago

So this is about how someone hacked Bugzilla, extracted sensitive information about a vulnerability in Firefox' PDF engine, wrote a weaponized exploit for it, deployed it as malvertising and stole some of the most sensitive files you can get out of a user's computer... ...and then the FAQ document linked is a PDF file with no styling beyond something that could be done with HTML <h1>, <p> and <a>, hosted on a domain "ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com". Did I just get trolled?

yuhong 11y ago
It if not a vulnerability in the PDF.js engine themselves.
- 0x0 11y ago
  The original advisory certainly seems to implicate the PDF viewer component? https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-7...
  - azakai 11y ago
    Yes, but it has been fixed a while ago though. No one using up to date Firefox would be vulnerable to that issue.
    - deleted 11y ago
      [deleted]
  - yuhong 11y ago
    What I mean is that it is caused by how PDF.js is integrated into Firefox.