Firefox 36 Gains HTTP/2 Support, Fixes Critical Vulnerabilities

Mozilla has rolled out its second major milestone release of the Firefox browser so far in 2015. Firefox 36 provides security fixes and improvements, and is the first version of Firefox to fully support the new HTTP/2 protocol.

HTTP/2 is the successor to HTTP 1.1, the protocol on which the Web has run since 1999. On 18 February, Mark Nottingham, chair of the IETF HTTP Working Group, declared that HTTP/2 is done—meaning the basic definition of the HTTP/2 protocol has been finalized and now the specification is going through the final phases of the standards process.

Multiple improvements were made to HTTP/2 to make network transport more efficient and more secure than the current HTTP 1.1 protocol. Mozilla’s Firefox 36 release notes refer to HTTP/2 as enabling “a faster more scalable and more responsive web.”

Security improvements

Overall though, the big emphasis in Firefox 36 is in the area of Web security. Starting with Firefox 36, Mozilla is now phasing out a number of 1,024-bit root certificates that are used for Web encryption. The move is part of a planned migration toward more secure encryption certificates that use 2,048-bit or higher encryption keys.

Also as part of Firefox 36, the browser is no longer accepting insecure RC4 encryption ciphers. RC4 at one point was a widely deployed encryption technology, but it has been shown to be theoretically exploitable.

Mozilla isn’t the only group moving away from the use of RC4 this week, as security vendor CloudFlare has also announced that it is now disabling RC4 support for all SSL/TLS connections to CloudFlare sites.

As part of the Firefox 36 release, Mozilla has issued 17 security advisories for vulnerabilities that have been patched in the browser. Of those 17 advisories, only three are rated by Mozilla as being critical.

Critical update

Among the critical advisories is MSFA-2015-11, which fixes multiple memory safety flaws in Firefox, including CVE-2015-0835 and CVE-2015-0836. Memory security is also addressed in a critical security advisory for the CVE-2015-0831 Use-After-Free memory vulnerability in Firefox’s IndexedDB, which helps to enable client-side storage of data. The third critical advisory deals with a buffer overflow identified as CVE-2015-0829.

“Security researcher Pantrombka reported a buffer overflow in the libstagefright library during video playback when certain invalid MP4 video files led to the allocation of a buffer that was too small for the content,” Mozilla warned in its advisory. “This led to a potentially exploitable crash.”

In addition to the critical vulnerabilities, there are a number of other interesting flaws that are fixed in Firefox 36. One such flaw is a low impact vulnerability identified as CVE-2015-0834, which deals with TURN (Traversal Using Relay NAT) and STUN (Session Traversal for NAT) servers not properly securing TLS (Transport Layer Security). Both TURN and STUN are techniques for enabling a connection to navigate across Network Address Translation (NAT).

There is also a flaw identified as CVE2015-0822 that was fixed in Firefox 36 that could have enabled the Website form auto-complete feature to lead to unauthorized information disclosure.

“Security researcher Armin Razmdjou reported that a user readable file in a known local path could be uploaded to a malicious site,” Mozilla warned in its advisory. “While the local file is not visibly uploaded through the form, its contents are made available through the Document Object Model (DOM) to script content on the attacking page, leading to information disclosure.”

Are you a Firefox enthusiast? Take our quiz!

Originally published on eWeek.