RomCom exploits Firefox and Windows zero days in the wild

(welivesecurity.com)

42 points | by croes 5 hours ago ago

21 comments

  • elphinstone 2 hours ago

    Good on Mozilla for the rapid response.

  • galangalalgol 3 hours ago

    Another use after free... I'm on board with cisa on this one. If you add new code to a sw project in c or c++ that should be a solid case for negligence when your customers sue for losses.

    • throw16180339 an hour ago

      Please let us know when Rust has an AIX, i/OS, z/OS, Nonstop OS, OpenVMS, or Stratus VOS target.

      • tux3 an hour ago

        The headline is about Firefox on Windows for a good reason: that's where the regular users are.

        If you want Rust on Nonstop, a niche proprietary platform, your large financial company is welcome to invest in it.

      • lmm 33 minutes ago

        > AIX, i/OS, z/OS, Nonstop OS, OpenVMS, or Stratus VOS

        A list of which Firefox runs on precisely none.

    • oguz-ismail 3 hours ago

      > I'm on board

      and who are you?

      • do_not_redeem 2 hours ago

        His name is galangalalgol. Fashionable, visionary leader of the rust evangelism strike force. And don't you forget it.

        (Read in the voice of Tribore Menendez)

    • dmitrygr 3 hours ago

      > If you add new code to a sw project in c or c++ that should be a solid case for negligence when your customers sue for losses.

      Sure, as long as you are ok being similarly sued next time you install or use windows, macos, or linux on some box you administer. Those are all written in C. I guess you're OS-less until you write one in something safe. Ditto for web browsers and bootloaders.

      • lmm 29 minutes ago

        > next time you install or use windows, macos, or linux on some box you administer.

        I don't administer other people's boxes, I provide them with programs written in safe languages (as a bootable unikernel if they want). If they choose to run them on a buggy OS that's on them.

      • galangalalgol 3 hours ago

        Wasn't the first cut at windows me written in c#, maybe we can start there. The servo browser on redox isn't even completely free of c I think.

        • throw16180339 an hour ago

          I think you're thinking of Windows Longhorn (https://en.wikipedia.org/wiki/Development_of_Windows_Vista#M...). They used managed code and ended up partially scrapping it to restart development on top of Windows Server 2003.

        • smitelli 2 hours ago

          Windows ME was just Win98SE in an ugly sweater. Mostly C/C++ with some assembly peppered in.

        • xahrepap 2 hours ago
        • qskousen 3 hours ago

          Windows ME was the worst Windows though.

          • edm0nd 2 hours ago

            Hard agree.

            Windows 98SE SP2 was the best

          • do_not_redeem 2 hours ago

            Vista was the worst in my book. And Vista was actually the real turning point when C# started to infect Windows.

        • gpm 3 hours ago

          Servo relies on firefox's JS runtime spidermonkey, written in C++.

          • ekr____ 2 hours ago

            Moreover, a significant fraction of JS vulnerabilities are logic errors in the JIT, so even if the JIT itself is memory safe, that doesn't make the resulting code free of vulnerabilities.

      • njtransit 3 hours ago

        It’s not negligent it use an unsafe OS if no safer options exist. It is negligent to use an unsafe language when safe alternatives exist.

        • gigel82 2 hours ago

          Visual programming like Scratch is safer than Rust so it's negligent if we don't all use Scratch next.

          Also, everyone should pee sitting down by law because some are known to pee to on their pants otherwise.

          /s

    • ClassyJacket an hour ago

      I exaggerate alot but even by my standards this is ridiculous hyperbole. Rust just isn't supported on alot of platforms and libraries.