Firefox 0-day vulnerability in the wild

[Puppy]

https://www.wordfence.com/blog/2016/11/ ... -day-wild/
http://arstechnica.com/security/2016/11 ... d-in-2013/

- affects Firefox 41 to 50, incuding ESR and 50.0.1
- the exploit currently works on Windows only but other platforms are very likely affected as well
- it can run malicious code in context of logged user
- it is already being actively exploited, targets Tor (Firefox ESR based) browser
- the exploit code is disclosed so many other variants may already exists

The only workaround is to disable JavaScript or use another browser until fix is released.

[Puppy]

Fix is available, I strongly recommend to install it ASAP

Firefox 50.0.2
Thunderbird 45.5.1

[dr_st]

Pale Moon apparently also includes a fix for said vulnerability (CVE-2016-9079) in 27.0.2:
http://www.palemoon.org/releasenotes.shtml

[Saucey]

Looks like I'll have to update Pale Moon then, thanks!

[Summilux]

Thank you for the advices Puppy, I've updated both FF (just in case) and TB (used everyday).