How critical is vulnerability in Firefox 3.5.1?

In response to the reports on the vulnerability recently discovered in the latest version of Firefox on Sunday Mozilla made a statement saying that the bug is not exploitable. As is known last Thursday the company released a new version of its browser Firefox 3.5.1 which fixed a number of security holes in version 3.5 launched in June.

Last Friday reports began to come about a stack-based buffer overflow vulnerability in Firefox 3.5.1 that could be used to gain access to a computer or launch a distributed denial of service attack. Mozilla in its turn examined the reported vulnerability and said that it was not the case.

"The reports by press and various security agencies have incorrectly indicated that this is an exploitable bug. Our analysis indicates that it is not, and we have seen no example of exploitability," wrote Mike Shaver, Mozilla's vice president of engineering, in a blog post on Sunday.

Shaver said that while the bug leads to crash of the Firefox 3.5 and Firefox 3.5.1 on a Windows operated PCs it does not allows the attackers to access the computer. Besides, the bug also causes the crash of Firefox 3.0 and 3.5 to crash on Apple computers.

"A crash occurs inside the ATSUI system library (part of OS X), due to what appears to be a failure to check allocation results," Shaver said, adding the same issue could affect other applications using text-handling libraries in MacOS X. "We have reported this issue to Apple, but in the event that they do not provide a fix we will look to implement mitigations in Mozilla code."