Firefox 57.0.4: security fixes for Spectre and Meltdown

The full scope of the recently-discovered Spectre and Meltdown vulnerabilities is still being determined. It may be that hardware or firmware changes will be necessary to truly remove the danger. However, it’s still possible that operating system and application updates can mitigate the risk sufficiently for most purposes.

Once Microsoft demonstrated that the new timing-based attacks could be used in JavaScript code on a malicious web page to read data from other web sites, the folks at Mozilla decided to make that more difficult to accomplish in Firefox. Since the vulnerabilities are timing-dependent, Mozilla reduced the accuracy of several time sources within Firefox that could be used in Spectre and Meltdown based exploits.

The result is Firefox 57.0.4, released on January 4. It’s difficult to know just how helpful these changes will be, but if you use Firefox, you should install this update.

About jrivett

Jeff Rivett has worked with and written about computers since the early 1980s. His first computer was an Apple II+, built by his father and heavily customized. Jeff's writing appeared in Computist Magazine in the 1980s, and he created and sold a game utility (Ultimaker 2, reviewed in the December 1983 Washington Apple Pi Journal) to international markets during the same period. Proceeds from writing, software sales, and contract programming gigs paid his way through university, earning him a Bachelor of Science (Computer Science) degree at UWO. Jeff went on to work as a programmer, sysadmin, and manager in various industries. There's more on the About page, and on the Jeff Rivett Consulting site.

Leave a Reply