Browser bug could get early patch
8056
A fix for a browser bug may appear early if hackers exploit the loophole in large numbers, said Microsoft.
696978
The update for the Mozilla browser fixes an unusual vulnerability that could cause malicious code to run if the browser is launched by Microsoft's IE.
567801
A newly found vulnerability in Microsoft's Internet Explorer browser could allow an attacker to take over a targeted machine -- even one with all its patches up to date.
555449
Microsoft this week released a patch to fix an important vulnerability in Internet Explorer, even as a new worm that took advantage of an as-yet-unpatched hole in the Web browser spread.
659695
Microsoft has acknowledged that a bug fix for its Internet Explorer browser last week did, indeed, cripple the browser for some users. Rather than re-release the patch, it's telling users how to modify Windows' registry to get IE back up and running.
321788
Microsoft on Tuesday issued a patch for an earlier discovered flaw in Visual Studio 2005, while yet another cumulative patch for Internet Explorer was released, as well as one for a vulnerability within the Windows Media Format.
189807
Browser flaw may leave you vulnerable to phishing attacks.
641636
Critical bug-fixes ship for Internet Explorer, DirectX, and Windows Media Format technology.
386281
(InfoWorld) - Microsoft has quietly released a patch aimed at improving the performance of Internet Explorer 7's phishing filter ahead of the company's regular patching schedule, which occurs on the second Tuesday of every month. The update was made available last week on on Microsoft's Web site, according to a blog entry on IEBlog, which is written by the IE team at Microsoft. This update addresses an issue some users experience when navigating to a page with multiple frames or where frames are being navigated simultaneously, according to the post by IE Program Manager Steve Reynolds. This kind of navigation occurs when the IE phishing filter, which attempts to block access to sites that may try to defraud Web users, evaluates a Web page when a user navigates to it. The result is multiple simultaneous evaluations for the same page, Reynolds wrote in his post. In addition to being available on Microsoft's Web site now, the company also will release the patch later this month for Windows XP and Windows Server 2003. Phishing filter performance is not the only complaint IE 7 users have had since the final version was released in October. Frequent crashes and other performance problems such as excessive memory consumption that results in slow page loads have been reported.
352797
InfoWorld - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update.
753365
(InfoWorld) - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update. No, that's not a typo, just the strange fall-out from an unusual bug that had security researchers debating the question this week, "Who's to blame? Microsoft or Mozilla?" Security researcher Thor LarholmÂ kicked off the controversy on Tuesday, claiming that he had discovered a flaw that would let an attacker run commands on a victim's PC. In his blog posting, Larholm said the bug was similar to a flaw he'd discovered last month in Apple's Safari 3.0 beta software, and he called it an an "input validation flaw in Internet Explorer." The problem is with a URL protocol handler component of Internet Explorer, he said. This software allows Internet Explorer users to launch applications such as Excel or Firefox by clicking on specially written links on Web pages. When Internet Explorer clicks on a link that launches the Firefox browser, however, the software does not properly check its syntax, and that, Larholm said, lets an attacker create a malicious link, that could be used in an attack. Security vendor Secunia ApS rates the flaw as "highly critical." So while the flaw affects Internet Explorer users, it appears to be a risk only to those who already have Firefox installed. And to make matters more complicated, if a Firefox user were to click on one of the specially written links, he would not be affected. Still, Microsoft Security Program Manager Mark Griesi said that the bug was not his company's problem. "We don't feel that there's an issue in IE and therefore there's nothing to be fixed," he said Tuesday. With Microsoft saying it won't fix the vulnerability, Mozilla said it would change the way its Firefox URL protocol handler worked in its next Firefox update. That will fix Larholm's bug, but Mozilla security strategist Window Snyder wouldn't say whether or not she considered the vulnerability to be an IE or Firefox problem. She did, however, point out that without Microsoft making changes to IE, other Windows programs may be at risk. Noted browser bug-hunter Aviv Raff wrote in his blog that he thought both Microsoft and Mozilla were to blame. But another security expert said that the responsibility to fix the problem lies with the open-source browser developers. "This is an oversight in how Mozilla decided to construct their protocol registration, and how they do input validation between this handler and their application," said Eric Schultze, chief security architect with Shavlik Technologies, via e-mail. "I think Mozilla needs to write and release a patch for this issue and Microsoft can take the week off."
183325
Blog: Here's a follow up to a blog of a few days ago outlining workaround until Google issues a patch.
353081
Blog: Recently patched browser from Apple springs another leak.
119687
Updated browser that patches the problems is now available for download.
350003
TechWeb - The problematic fix, issued last December, affected the Firefox browser and the SeaMonkey application suite.
408824
Well, if you haven&#39;t patched your PC yet, now is the time. A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the
581272
Mozilla Foundation says patch issued in mid-December introduced vulnerability to browser and application suite.