Mozilla Increases Bug Bounty
Written by Alex Armstrong   
Friday, 12 June 2015

The top payout in Mozilla's Bug  Bounty Program has risen to $10,000 or more. Mozilla has also widened the range of vulnerabilities it covers.

mozilladev

 

The post on the Mozilla security blog indicates that this increase reflects the fact that Mozilla values its security researchers.

Ray Forbes writes:

The Bug Bounty Program is an important part of security here at Mozilla.  This program has paid out close to 1.6 million dollars to date and we are very happy with the success of it.  

Those of us on the Bug Bounty Committee did an evaluation of the Firefox bug bounty program as it stands and decided it was time for a change.

And the change means not only more money for critical vulnerabilities but also payouts for moderate ones.

Forbes continues::

We have dramatically increased the amount of money that a vulnerability is worth.  On top of that, we took a look at how we decided how much we should pay out.  Rather than just one amount that can be awarded, we are moving to a variable payout based on the quality of the bug report, the severity of the bug, and how clearly the vulnerability can be exploited.

He also says that the amount paid for Moderate rated vulnerabilities. will be determined by the committee, but the general range is $500 to $2000.  This doesn’t mean that all Moderate vulnerabilities will be awarded a bounty but some will.

 

This table shows what is required for each level of payment:

Type and level of bug Reward
Novel vulnerability and exploit, new form of exploitation or an exceptional vulnerability $10,000+
High quality bug report with clearly exploitable critical vulnerability $7,500
High quality bug report of a critical or high vulnerability $5000
Minimum for a high or critical vulnerability $3,000
Medium vulnerability $500- $2,500

 

The following general conditions apply:

  • Security bug must be original and previously unreported.
  • Security bug must be a remote exploit, the cause of a privilege escalation, or an information leak.
  • Submitter must not be the author of the buggy code nor otherwise involved in its contribution to the Mozilla project (such as by providing check-in reviews).
  • Employees of the Mozilla Foundation and its subsidiaries are ineligible. 

If two or more people report the bug together the reward will be divided among them.

mdnsq

More Information

Mozilla Client Bug Bounty Program

Changes to the Firefox Bug Bounty Program

Related Articles

Mozilla Offers $10K For Critical Flaws In New Certificate Verification Scheme

New Online Services Bug Bounty Program 

Microsoft Extends Bounty

Bounty Hunter Awarded $100,000

 

To be informed about new articles on I Programmer, install the I Programmer Toolbar, subscribe to the RSS feed, follow us on, Twitter, Facebook, Google+ or Linkedin,  or sign up for our weekly newsletter.

 

Banner

Google Opensources Privacy Library
08/11/2024

Google is making a new differential privacy library available as open source. PipelineDP4J is a Java-based library that can be used to analyse data sets while preserving privacy.


+ Full Story
Apache Fury Adds Optimized Serializers For Scala
31/10/2024

Apache Fury has been updated to add GraalVM native images and with optimized serializers for Scala collection. The update also reduces Scala collection serialization cost via the use of  encoding [ ... ]


+ Full Story
More News

 

espbook

 

Comments




or email your comment to: comments@i-programmer.info
Last Updated ( Friday, 12 June 2015 )