Firefox, IE7 open to URL spoof
124001
Firefox and Internet Explorer 7 do not properly handle JavaScript "onUnload" events and can be tricked into taking a user to the wrong URL, according to security researcher Michal Zalewski.
165927
Critical Opera and Firefox bugs menace IE-refuseniks There's bad news for users of alternative browsers this Friday, with both Opera and Firefox subject to security vulnerabilities.â¦
531748
On the heels of a new Netscape preview release and the launch of Firefox 1.0, a UK company has released a web browser it claims is more secure than Internet Explorer (IE) or Firefox.
70158
Pop goes the weasel A vulnerability in Firefox's popup blocker software creates a means to read files from affected systems, security researchers warn.â¦
417928
(InfoWorld) - Microsoft has released a patch for Internet Explorer 7 (IE7) that will boost the brand-new browser's performance on some Web sites. Some users had reported that the new phishing filter had been slowing down the PC's performance as IE evaluated the security of Web pages that contained a lot of frames. "When you use Windows Internet Explorer 7 to visit a Web page, the computer may respond very slowly as the phishing filter evaluates Web page contents," Microsoft said in a note published Tuesday. MicrosoftÂ introduced the filterÂ in IE7,Â released in mid-October, as a way of warning Web surfers when they might be visiting untrustworthy Web sites. The new patches are for Windows XP and Windows Server 2003 versions of IE7, but not for users running the browser on Windows Vista.
406027
Microsoft ISA and Proxy Server are prone to an Internet domain name spoofing vulnerability that could allow an attacker to spoof Internet sites.
558040
A new Web browser based on Firefox changes a computer's IP address every few minutes to make Web surfing more anonymous.
16648
Opt-out button in spam used to run exploit
221084
A newly reported security problem in Microsoft&#39;s Internet Explorer (IE) Web browser allows attackers to create a fake Web site that looks exactly like a genuine site.
466055
A newly reported security problem in Microsoft's Internet Explorer (IE) Web browser allows attackers to create a fake Web site that looks exactly like a genuine site.
416887
(InfoWorld) - Makers of some of the most popular extension software used by the Firefox browser are not doing enough to secure their software, a security researcher said Wednesday. The problem is that many widely used Firefox extensions, including toolbars from Google, Yahoo, and AOL, do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher who blogged about the issue on Wednesday. Soghoian is best known as the researcher who attracted the attention of the FBI late last year after publishing a tool that could be used to print fake boarding passes. The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the SSL Web protocol. SSL Web sites, which begin with "https://," use digital certificates to provide users with some level of assurance that they're not connecting with a fake server. Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled Web site, it is common for commercial extension-makers like Google to host their software on an unsecured site, Soghoian said in an interview. This leaves users vulnerable to a "man-in-the middle" attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension. It wouldn't be easy for an attacker to pull this off, however. In one scenario, the hacker would set up a malicious wireless access point in a public area where people are using wireless connections. He could then redirect extension update traffic to a malicious computer. "An attacker who sets up a wireless access point can then infect anyone who connects to it," Soghoian said. The Del.icio.us Extension, Facebook Toolbar, Ask.com Toolbar, LinkedIn Browser Toolbar, Netcraft Anti-Phishing Toolbar, and PhishTank SiteChecker are also vulnerable to this issue, Soghoian said. Though Soghoian said Firefox users should avoid extensions that are not from the secure Firefox add-ons site, not all security researchers see this as a major issue. "It's just yet another vulnerable design among billions,"said Gadi Evron, security evangelist for Beyond Security. "I don't see it as that critical. There is no inherent vulnerability, but it does make the over-whole design weaker, and that should probably be addressed" Evron said it was "silly" that sites weren't using SSL for these extensions. Soghoian said he notified Google, Yahoo, and Facebook of the issue in mid-April, but nobody had addressed the issue as of Wednesday. Just hours after Soghoian went public with his findings, Google said it would "soon" have a fix for the problem. It's common for Web developers to ignore security in the rush to push out new and cool features, Soghoian said. "Your average Web 2.0 developer doesn't learn about security," he said. "Google has a spectacular security team ... my suspicion is that one hand wasn't talking to the other."
607294
Recently disclosed security holes that affect Internet Explorer 7 and Firefox could let attackers grab data via malicious Web sites.
83266
(InfoWorld) - A new update for the Firefox browser fixes an unusual vulnerability that could cause malicious code to run if the browser is launched by Microsoft's Internet Explorer. The critical vulnerability involves Internet Explorer's ability to launch other applications such as Excel or Firefox after a user clicks on a specially written link in a Web page. Explorer does not properly check the syntax of the link, which could allow a malicious link to attack Firefox if launched, according to Mozilla, the open source project that develops Firefox. Microsoft said itÂ didn't feel it was an issue for Explorer. Either way, Firefox's 2.0.0.5 release fixes the problem by now validating incoming data. The update will automatically be pushed out to Firefox 2.0 users via the built-in update system, Mozilla said in an advisory. The update also fixes seven other vulnerabilities, two of which are considered "critical" by Mozilla. One problem, labelled 2007-18, is a memory corruption problem that could cause arbitrary code to run on a machine. The other, 2007-21, could also allow arbitrary code to run.
535328
Mozilla is starting to pose a threat to Microsoftâs Internet Explorer after years of being the darling of a strange mix of AOL enthusiasts and techies.
497821
Alternative browser features protection against online scams.
241440
Blog: Patches include the Firefox portion of the IE-Firefox flaw identified last week.
758956
Hole could allow remote attackers to access your local search results.