Mozilla Fixes Critical Firefox Flaws
119687
Updated browser that patches the problems is now available for download.
29646
Users of Firefox yesterday began receiving notices of the availability of version 2.0.0.7, which the Mozilla organization said addresses a vulnerability involving Apple's QuickTime plug-in. In BetaNews tests of the new version this afternoon, the vulnerability in question appears to have been fully patched.
450858
New vulnerabilities include a critical flaw in Internet Explorer and a "major" bug in Firefox.
526152
The Mozilla Foundation has fixed 10 security bugs in its open-source Mozilla and Mozilla Firefox browsers and Thunderbird e-mail reader, with the release of new versions of all three products this week. Some of the vulnerabilities could allow attackers to run malicious code on a user's PC via a malicious e-mail, a specially crafted vCard or a malformed graphic on a Web site, project leaders said.
449251
Mozilla bumped up the threat ranking for an unpatched Firefox bug to "high," but promises a quick fix.
369010
(InfoWorld) - Mozilla patched its flagship Firefox browser Thursday with fixes for six vulnerabilities, one of which was stamped "critical" by the open-source developer. This was the third time Mozilla has updated Firefox in 2007. The updates bring the current browser to Version 2.0.0.4 and the 2005 edition to 1.5.0.12. MFSA 2007-12, the most serious of the six, patched 30 separate memory corruption bugs in the browser layout and JavaScript engines. Even Mozilla seemed unsure of their impact. "Some of these crashes showed evidence of memory corruption under certain circumstances, and we presume that with enough effort, at least some of these could be exploited to run arbitrary code," the advisory read. Mozilla warned Thunderbird and SeaMonkey that their e-mail software, which shares Firefox's layout engine, may be vulnerable to these bugs as well. The developers recommend that users do not enable JavaScript in Thunderbird or the mail portion of SeaMonkey. The updates also fix a pop-up bug that could be used to mask parts of the browser, such as the address bar; a cross-site scripting vulnerability; a problem with how the browsers handle cookies; and a flaw that could let attackers crash Firefox using its autocomplete feature. Firefox 2.0.0.4 can be downloaded from the Mozilla Web site for Windows, Mac OS X, and Linux; Firefox 1.5.0.12, meanwhile, is available from a different page. Current users can also update using the Check for Updates command in the help menu. Mozilla also reiterated that Thursday's patches would be Firefox 1.5's last and said that an update to Firefox 2.0.0.4 would be offered to its users "over the coming weeks." Although Firefox ended 2006 on an upbeat security note according to Symantec -- the anti-virus vendor tallied 40 patches in the last six months of the year, 26 percent fewer than the 54 released for rival browser Internet Explorer -- so far this year, Mozilla has addressed more than twice as many vulnerabilities as IE. In the first five months of 2007, 22 bugs in Firefox have been patched, nine of which were pegged as critical. Microsoft has fixed only eight in IE; seven were labeled critical.
241440
Blog: Patches include the Firefox portion of the IE-Firefox flaw identified last week.
685180
Even though it was patched twice in July, Mozilla's Firefox browser is still vulnerable to attacks exploiting protocol-handling bugs, according to security researchers.
74642
Mozilla Corp. has released the last planned alpha update to Firefox 3.0; the new browser moves to beta testing at the end of the month and is due out in final form by the end of the year.
143035
Mozilla releases the third beta of Firefox 3, eight weeks after it made the last major milestone for its open-source browser.
260192
Mozilla will patch a security bug in Firefox that could be attacked in Internet Explorer.
83266
(InfoWorld) - A new update for the Firefox browser fixes an unusual vulnerability that could cause malicious code to run if the browser is launched by Microsoft's Internet Explorer. The critical vulnerability involves Internet Explorer's ability to launch other applications such as Excel or Firefox after a user clicks on a specially written link in a Web page. Explorer does not properly check the syntax of the link, which could allow a malicious link to attack Firefox if launched, according to Mozilla, the open source project that develops Firefox. Microsoft said itÂ didn't feel it was an issue for Explorer. Either way, Firefox's 2.0.0.5 release fixes the problem by now validating incoming data. The update will automatically be pushed out to Firefox 2.0 users via the built-in update system, Mozilla said in an advisory. The update also fixes seven other vulnerabilities, two of which are considered "critical" by Mozilla. One problem, labelled 2007-18, is a memory corruption problem that could cause arbitrary code to run on a machine. The other, 2007-21, could also allow arbitrary code to run.
297679
Mozilla has released alpha 8 of its Firefox 3.0 Web browser, unveiling for the first time to users several security features it's talked up for months.
752478
InfoWorld - Mozilla issued 10 patches on Friday for its Firefox browser, including three for critical vulnerabilities. The latest version of Firefox is now 2.0.0.12.
589129
The Mozilla Foundation has released version 1.0 of its Firefox browser, an open-source product that has generated lofty expectations that it will offer real competition to Microsoft&#39;s ubiquitous Internet Explorer.
307137
Mozilla has pushed to users minor upgrades to both Firefox and the Thunderbird e-mail client, with both including seven security patches each and improvements to product stability.
588768
InfoWorld - Mozilla has released a critical security update to Firefox, taking a third shot at patching bugs in the way the browser can be used to launch programs from Web links.