Mozilla Duped by Hacker's 'Humorous' Presentation
2920
A Firefox 'flaw' revealed at a hacker conference over the weekend was a joke, hacker admits.
599698
A London security analyst working with the open source group GNUCitizen has discovered a potentially serious exploit that could affect users of the Firefox browser and Apple's QuickTime movie and music player - especially iTunes customers - on Windows XP-based machines. BetaNews tested and verified the severity of the exploit.
68684
Image files found on image-hosting sites look harmless, but conceal PHP exploit code.
526677
Come ampiamente annunciato, Mozilla Foundation, dopo Firefox, ha rilasciato la versione 1.0 di Thunderbird, client di posta elettronica che dovrebbe costituire una valida alternativa ad Oulook. Le premesse
145367
(InfoWorld) - In a public mea culpa, Mozilla's chief security officer acknowledged Monday that Firefox includes the same flaw that the company called a "critical vulnerability" in Internet Explorer during a two-week ruckus over responsibility for a Windows zero-day bug. "Over the weekend, we learned about a new scenario that identifies ways that Firefox could also be used as the entry point," said Window Snyder of Mozilla. "While browsing with Firefox, a specially crafted URL could potentially be used to send bad data to another application. "We thought this was just a problem with Internet Explorer," Snyder continued. "It turns out, it is a problem with Firefox as well." The argument over responsibility for a flaw that involved both Internet Explorer and Firefox began two weeks ago when Danish researcher Thor Larholm argued that Internet Explorer contained an input validation bug that passes potentially malicious URLs to other applications. Larholm called out Firefox's "firefoxurl://" protocol as one that Internet Explorer mishandled. He staked out the position that Internet Explorer was to blame, while other security experts said it was Firefox's fault. As fingers pointed, Mozilla patched the Internet Explorer-Firefox interaction bug by releasing an update, Version 2.0.0.5. Even so, Snyder and others continued to argue that Internet Explorer was the problem. "Microsoft needs to patch Internet Explorer," Snyder said last Wednesday. That same day, Asa Dotzler, director of community development, contrasted what he said were the differences between Microsoft and Mozilla on the bug. "We think it's Firefox's job to ensure that users are protected from malicious Web sites when they're surfing the Web in Firefox. Apparently, Microsoft doesn't think the same for Internet Explorer," Dotzler said then. Friday, Jesper Johansson, a former Microsoft security strategist but now a security program manager at Amazon.com, spelled out how Firefox was as guilty as Internet Explorer of failing to validate input. In a post that leaned on the metaphor of "glass houses," Johansson showed how Firefox passes potentially malicious URLs to other applications, including the multiple-service instant messaging client Trillian. "Firefox is subject to the exact same flaw that they blame on Internet Explorer. Firefox also does not escape quotes in URLs before it passes them on to protocol handlers," he said. Snyder did not credit Johansson by name for alerting Mozilla to the Firefox bug, but she admitted that the flaw should have been spotted. "We should have caught this scenario when we fixed the related problem in 2.0.0.5," she said. She did not specify when a patch would be issued, but one is in the works, according to an entry in Bugzilla.
727620
A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla Corp. said it plans to patch the problem in its next Firefox software update.
220418
Mozilla disclosed Monday that it had opened up a vulnerability with a previous security fix for its Firefox, Seamonkey, and Thunderbird clients. According to an advisory issued Monday, a new JavaScript issue was introduced that would allow coding from Web content to be exploited to execute arbitrary code.
619489
In the very week Mozilla Firefox Version 1.0 was launched, a series of potentially nasty security holes have been uncovered in older versions of the browser.
132488
Some prompts and websites that download browser plug-ins are turning out to be fronts for malicious programing.
645222
Mozilla's Mike Shaver tells us how the redesign of Firefox's community site will better serve its web tinkerers. Wired News Q&A by Michael Calore.
93571
A zero-day flaw in Firefox and third-party Windows patches turn up the heat for Net users. Plus: Buyout boom in security.
620094
roundup Free-roaming source code breeds new Netsky pest. Also: From IE to Opera, browsers are a likely prey.
127768
Third-party fix plugs a recently discovered browser flaw that's increasingly being exploited in cyberattacks.
177433
Firefox attack a 'stand up comedy routine' Two presenters razzed developers of the open source Mozilla browser this weekend at the ToorCon hacking convention in San Diego with claims that the browser's Javascript implementation is flawed, but the lecture appears to have been more stand-up comedy routine than substantiative research.â¦
687388
The latest release of Mozilla's lightweight browser for the Mac hints at a major upgrade around the corner. In Monkey Bites.
254092
A Firefox 'flaw' revealed at the Toorcon hacker conference over the weekend was a joke, one of the hackers admited to Mozilla officials.
747017
Mozilla is investigating hacker claims that the Web browser has a serious flaw in the way it handles JavaScript.