After-Life Vulnerabilities: A Study on Firefox Evolution, Its Vulnerabilities, and Fixes

  • Fabio Massacci
  • Stephan Neuhaus
  • Viet Hung Nguyen
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6542)


We study the interplay in the evolution of Firefox source code and known vulnerabilities in Firefox over six major versions (v1.0, v1.5, v2.0, v3.0, v3.5, and v3.6) spanning almost ten years of development, and integrating a numbers of sources (NVD, CVE, MFSA, Firefox CVS). We conclude that a large fraction of vulnerabilities apply to code that is no longer maintained in older versions. We call these after-life vulnerabilities. This complements the Milk-or-Wine study of Ozment and Schechter—which we also partly confirm—as we look at vulnerabilities in the reference frame of the source code, revealing a vulnerabilitiy’s future, while they looked at its past history. Through an analysis of that code’s market share, we also conclude that vulnerable code is still very much in use both in terms of instances and as global codebase: CVS evidence suggests that Firefox evolves relatively slowly.

This is empirical evidence that the software-evolution-as-security solution—patching software and automatic updates—might not work, and that vulnerabilities will have to be mitigated by other means.


Software Vendor Software Security Local Vulnerability Software Instance Total Vulnerability 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Howard, M., Lipner, S.: The Security Development Lifecycle. In: Secure Software Development. Microsoft Press, Redmond (May 2006)Google Scholar
  2. 2.
    McGraw, G., Chess, B., Migues, S.: Building Security In Maturity Model v 1.5 (Europe Edition). Fortify, Inc., and Cigital, Inc. (2009)Google Scholar
  3. 3.
    Ozment, A., Schechter, S.E.: Milk or wine: Does software security improve with age? In: Proceedings of the 15th Usenix Security Symposium. USENIX Association, Berkeley (August 2006)Google Scholar
  4. 4.
    Hethcote, H.W.: The mathematics of infectious diseases. SIAM Review 42(4), 599–653 (2000)MathSciNetCrossRefzbMATHGoogle Scholar
  5. 5.
    Massacci, F., Nguyen, V.H.: Which is the right source for vulnerabilities studies? an empirical analysis on mozilla firefox. In: Proc. of MetriSec 2010 (2010)Google Scholar
  6. 6.
    Bird, C., Bachmann, A., Aune, E., Duffy, J., Bernstein, A., Filkov, V., Devanbu, P.: Fair and balanced?: bias in bug-fix datasets. In: Proceedings of the 7th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering, pp. 121–130. Association for Computing Machinery. ACM Press, New York (2009)Google Scholar
  7. 7.
    Bozorgi, M., Saul, L.K., Savage, S., Voelker, G.M.: Beyond heuristics: Learning to classify vulnerabilities and predict exploits (July 2010)Google Scholar
  8. 8.
    Ozment, A.: The likelihood of vulnerability rediscovery and the social utility of vulnerability hunting. In: Proceedings of 2nd Annual Workshop on Economics and Information Security, WEIS 2005 (2005)Google Scholar
  9. 9.
    Ozment, A., Schechter, S.E.: Milk or wine: Does software security improve with age? In: Proceedings of the 15th Usenix Security Symposium, USENIX 2006 (2006)Google Scholar
  10. 10.
    Rescorla, E.: Is finding security holes a good idea? IEEE Security and Privacy 3(1), 14–19 (2005)CrossRefGoogle Scholar
  11. 11.
    Alhazmi, O., Malaiya, Y., Ray, I.: Measuring, analyzing and predicting security vulnerabilities in software systems. Computers & Security 26(3), 219–228 (2007)CrossRefGoogle Scholar
  12. 12.
    Alhazmi, O., Malaiya, Y.: Modeling the vulnerability discovery process. In: Proceedings of the 16th IEEE International Symposium on Software Reliability Engineering, pp. 129–138 (2005)Google Scholar
  13. 13.
    Alhazmi, O., Malaiya, Y.: Application of vulnerability discovery models to major operating systems. IEEE Trans. on Reliab. 57(1), 14–22 (2008)CrossRefGoogle Scholar
  14. 14.
    Anderson, R.: Security in open versus closed systems - the dance of Boltzmann, Coase and Moore. In: Proceedings of Open Source Software: Economics, Law and Policy (2002)Google Scholar
  15. 15.
    Chowdhury, I., Zulkernine, M.: Using complexity, coupling, and cohesion metrics as early predictors of vul. Journal of Software Architecture (2010)Google Scholar
  16. 16.
    Gegick, M., Rotella, P., Williams, L.A.: Predicting attack-prone components. In: Proc. of the 2nd Internat. Conf. on Software Testing Verification and Validation (ICST 2009), pp. 181–190 (2009)Google Scholar
  17. 17.
    Jiang, Y., Cuki, B., Menzies, T., Bartlow, N.: Comparing design and code metrics for software quality prediction. In: Proceedings of the 4th International Workshop on Predictor Models in Software Engineering (PROMISE 2008), pp. 11–18. ACM, New York (2008)CrossRefGoogle Scholar
  18. 18.
    Menzies, T., Greenwald, J., Frank, A.: Data mining static code attributes to learn defect predictors. IEEE Transactions on Software Engineering 33(9), 2–13 (2007)CrossRefGoogle Scholar
  19. 19.
    Neuhaus, S., Zimmermann, T., Holler, C., Zeller, A.: Predicting vulnerable software components. In: Proceedings of the 14th ACM Conference on Communications and Computer Security (CCS 2007), pp. 529–540 (October 2007)Google Scholar
  20. 20.
    Shin, Y., Williams, L.: An empirical model to predict security vulnerabilities using code complexity metrics. In: Proceedings of the 2nd International Symposium on Empirical Software Engineering and Measurement, ESEM 2008 (2008)Google Scholar
  21. 21.
    Shin, Y., Williams, L.: Is complexity really the enemy of software security? In: Proceedings of the 4th Workshop on Quality of Protection (QoP 2008), pp. 47–50 (2008)Google Scholar
  22. 22.
    Zimmermann, T., Nagappan, N.: Predicting defects with program dependencies. In: Proceedings of the 3rd International Symposium on Empirical Software Engineering and Measurement, ESEM 2009 (2009)Google Scholar
  23. 23.
    Zimmermann, T., Premraj, R., Zeller, A.: Predicting defects for eclipse. In: Proceedings of the 3th International Workshop on Predictor Models in Software Engineering (PROMISE 2007). IEEE Computer Society, Los Alamitos (2007)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Fabio Massacci
    • 1
  • Stephan Neuhaus
    • 1
  • Viet Hung Nguyen
    • 1
  1. 1.Università degli Studi di TrentoTrentoItaly

Personalised recommendations