After-Life Vulnerabilities: A Study on Firefox Evolution, Its Vulnerabilities, and Fixes

We study the interplay in the evolution of Firefox source code and known vulnerabilities in Firefox over six major versions (v1.0, v1.5, v2.0, v3.0, v3.5, and v3.6) spanning almost ten years of development, and integrating a numbers of sources (NVD, CVE, MFSA, Firefox CVS). We conclude that a large fraction of vulnerabilities apply to code that is no longer maintained in older versions. We call these after-life vulnerabilities. This complements the Milk-or-Wine study of Ozment and Schechter—which we also partly confirm—as we look at vulnerabilities in the reference frame of the source code, revealing a vulnerabilitiy’s future, while they looked at its past history. Through an analysis of that code’s market share, we also conclude that vulnerable code is still very much in use both in terms of instances and as global codebase: CVS evidence suggests that Firefox evolves relatively slowly. This is empirical evidence that the software-evolution-as-security solution— patching software and automatic updates—might not work, and that vulnerabilities will have to be mitigated by other means.