Pwn2OwnAPCUDidn'tWant

Pwn2Own is in full swing, so that you too can win inferior x86 hardware by cracking it (and/or cash money), and it looks like Firefox has fallen. Details of the flaws are being reviewed internally, but I think I can say without violating confidences that one of the proofs-of-concept is pretty inventive and unfortunately cross-platform -- even though it (ab)uses components we don't fully support, these components are enabled, so the attack actually works against us too as confirmed on my G5.

Because Zero-Day Initiative is planning to pay for every exploit, even ones that don't "win," we can expect more attacks from this year's hijinx and hilarity. This may mean that 24.4 will be delayed, which will also hopefully have our own fixes for issues 260 and 261, along with backing out the user agent change (issue 259). I'm still hoping for a weekend release in time for the usual switchover next Monday night.

I haven't been able to get 29 up and running in time for an aurora. All the patches are down, which required restoring our WebRTC QuickTime backend, our AltiVec WebM acceleration interfaces, portions of our ATSUI webfont support and the Color Manager colour management code, but on top of that there were a lot of changes in JavaScript I have to account for and it's still not building yet. I'm shooting for beta, maybe, and then a 31 aurora; at least we have 31.0 and 31.1 to get it working before 24ESR ends support. I still don't know yet if Australis can be coerced to work on Tiger, and the biggest problem reported in 29 relevant to us is an endian problem in handles which also affects PowerPC Linux that completely prevents the browser from starting. No one has been able to figure this out yet and I won't be able to debug it myself until I get the browser to build (if it will on 10.4), so technically minded PPC Linux users in the audience might want to have a look at this or you won't have a Firefox 29 either.