Mozilla Ups Firefox Bug Threat, Slates Fix for Feb. 5
449251
Mozilla bumped up the threat ranking for an unpatched Firefox bug to "high," but promises a quick fix.
29646
Users of Firefox yesterday began receiving notices of the availability of version 2.0.0.7, which the Mozilla organization said addresses a vulnerability involving Apple's QuickTime plug-in. In BetaNews tests of the new version this afternoon, the vulnerability in question appears to have been fully patched.
492868
TechWeb - A new proof-of-concept code is circulating for a Firefox vulnerability that was fixed in Mozilla's security update that was released last week.
188255
Pass the parcel bug binned Mozilla has pushed out a new version of Firefox that fixes a number of security bugs, including a high-profile bug involving launching Firefox from Internet Explorer.â¦
450858
New vulnerabilities include a critical flaw in Internet Explorer and a "major" bug in Firefox.
266046
Mozilla has released a preview version of its open source FireFox Web browser. FireFox 1.0PR includes some bug fixes and many new features, including Live Bookmarks, a new Find toolbar and better IE compatability.
93571
A zero-day flaw in Firefox and third-party Windows patches turn up the heat for Net users. Plus: Buyout boom in security.
143981
(InfoWorld) - MozillaÂ has released an update to its Firefox browser, fixing a number of security flaws in the product. The Firefox 2.0.0.2 release includes a fix for a bug disclosed by security researcher Michal Zalewsky last week. That flaw can be exploited by attackers to manipulate cookie information in the Firefox browser, making it probably the most important fix in the update, according to Window Snyder, Mozilla's head of security strategy. "The potential to compromise a user's account is almost as serious as compromising their machine," she said Friday via instant message. "Since the details of how to exploit the vulnerability are publicly available, the risk to users is increased." The updates also include a fix for a previously undisclosed memory corruption flaw in the browser that could be exploited to run unauthorized software on a Firefox user's computer. This flaw could also affect Thunderbird users who have configured their mail client to run JavaScript automatically, something that Mozilla does not recommend. Thunderbird is Mozilla's free e-mail client. The patches were released on Friday afternoon and should soon be delivered via Firefox's automatic software update mechanism, Snyder said. Mozilla has patched a total of seven Firefox bugs and is also addressing two bugs in Thunderbird. The latest browser release also includes enhancements to make it run better with Windows Vista as well as support for the Afrikaans, Belarusian, Georgian, and Kurdish languages.
753365
(InfoWorld) - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update. No, that's not a typo, just the strange fall-out from an unusual bug that had security researchers debating the question this week, "Who's to blame? Microsoft or Mozilla?" Security researcher Thor LarholmÂ kicked off the controversy on Tuesday, claiming that he had discovered a flaw that would let an attacker run commands on a victim's PC. In his blog posting, Larholm said the bug was similar to a flaw he'd discovered last month in Apple's Safari 3.0 beta software, and he called it an an "input validation flaw in Internet Explorer." The problem is with a URL protocol handler component of Internet Explorer, he said. This software allows Internet Explorer users to launch applications such as Excel or Firefox by clicking on specially written links on Web pages. When Internet Explorer clicks on a link that launches the Firefox browser, however, the software does not properly check its syntax, and that, Larholm said, lets an attacker create a malicious link, that could be used in an attack. Security vendor Secunia ApS rates the flaw as "highly critical." So while the flaw affects Internet Explorer users, it appears to be a risk only to those who already have Firefox installed. And to make matters more complicated, if a Firefox user were to click on one of the specially written links, he would not be affected. Still, Microsoft Security Program Manager Mark Griesi said that the bug was not his company's problem. "We don't feel that there's an issue in IE and therefore there's nothing to be fixed," he said Tuesday. With Microsoft saying it won't fix the vulnerability, Mozilla said it would change the way its Firefox URL protocol handler worked in its next Firefox update. That will fix Larholm's bug, but Mozilla security strategist Window Snyder wouldn't say whether or not she considered the vulnerability to be an IE or Firefox problem. She did, however, point out that without Microsoft making changes to IE, other Windows programs may be at risk. Noted browser bug-hunter Aviv Raff wrote in his blog that he thought both Microsoft and Mozilla were to blame. But another security expert said that the responsibility to fix the problem lies with the open-source browser developers. "This is an oversight in how Mozilla decided to construct their protocol registration, and how they do input validation between this handler and their application," said Eric Schultze, chief security architect with Shavlik Technologies, via e-mail. "I think Mozilla needs to write and release a patch for this issue and Microsoft can take the week off."
307137
Mozilla has pushed to users minor upgrades to both Firefox and the Thunderbird e-mail client, with both including seven security patches each and improvements to product stability.
7141
(Article Central) Microsoft released its October batch of security advisories this week, with a number of &quot;critical&quot; patches, including a significant fix for the Internet Explorer browser.
445454
Mozilla chief security officer says Firefox has the same flaw that the company called a "critical vulnerability" in IE, patch is in the works.
630854
Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.
585748
Mozilla Corp. released updated versions of Firefox Friday to patch 14 vulnerabilities, three of them critical, but it pushed out the new versions without fixing several flaws.
739533
A vulnerability in the way the Firefox browser handles Javascript drew attention at a Saturday presentation at the ToorCon hacker conference, and Mozilla developers entered the week "heads down" in search of a solution.
504591
InfoWorld - With the release of its latest Firefox 2.0.0.5 browser, open-source software maker Mozilla claims to have fixed a number of potentially serious vulnerabilities in its flagship product.
760196
A security update slated to be released this week for the Firefox Web browser has been delayed by a day to Mozilla Corp. can test out a fix for a vulnerability made public last week.