Mozilla security takes axe to redundant code
599042
Slim is in Mozilla Corporation has hired a former security strategist from Microsoft as part of its efforts to improve the security of its software, in particular its flagship Firefox web browser software.â¦
302247
Mozilla issued 10 patches on Friday for its Firefox browser, including three for critical vulnerabilities. The latest version of Firefox is now 2.0.0.12.One of the critical vulnerabilities, MFSA 2008-06, is a problem in the way the browser handles images on certain Web pages.It&#39;s possible to exploit the flaw to steal a person&#39;s Web browsing history, forward that information and then crash the browser. It may also be possible to run arbitrary code on a machine, Mozilla said.A second critical vulnerability can enable a privilege escalation attack or remote code execution.The last critical problem involves a memory corruption flaw that &quot;we presume that with enough effort at least some of these could be exploited to run arbitrary code,&quot; Mozilla said.Also notable is a fix for a problem with Mozilla&#39;s &quot;chrome&quot; protocol, which is the term Mozilla uses for its user interface. The problem involves some of Firefox&#39;s add-ons, or applications that users can download which extend browser functionality.The vulnerability would let an attacker determine what applications are installed on a person&#39;s PC, which could give clues to how the machine could be compromised, Mozilla said. However, a victim would have to be lured to a special malicious Web page designed to take advantage of the flaw.&#160;
60742
On July 10, engineers at Secunia issued a security advisory, rated "Highly Critical," warning Firefox users that their browser could be tricked into executing arbitrary JavaScript code. While Internet Explorer was originally blamed for the ability to trick Firefox, as it turns out, Mozilla admitted today its own browser is to blame, even after a patch was released.
166875
I was reading LWN where there were reports of security holes in a dozen different packages based off Mozilla's Gecko. Someone complained about the lack of a universal library that they should all use so that users would only need to update the library and not each program separately. Apparently such a library exists as libxul, but its use is uncommon enough that the bugs were reported as being for the several separate programs and not for "libxul".
455894
Rolling update method deprives Java users of needed  patches, security vendor says.
450858
New vulnerabilities include a critical flaw in Internet Explorer and a "major" bug in Firefox.
168737
Just days after the Mozilla Foundation released the final version of its standalone Firefox browser, a security firm Thursday said that earlier editions were buggy and should be replaced.
727620
A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla Corp. said it plans to patch the problem in its next Firefox software update.
465554
(InfoWorld) - One of the hackers who demonstrated exploit code for a vulnerability in the way the Firefox browser handles Javascript at a hacker conference in San Diego admitted Tuesday that the presentation was meant to be a joke, the chief of security for Mozilla has said. Mozilla security researchers spent most of Sunday and Monday scrambling to determine if exploit code revealed during a presentation by hackers Mischa Spiegelmock and Andrew Wbeelsoi at Toorcon over the weekend could allow someone to execute malicious code through a memory corruption attack on Firefox. However, Window Snyder, who leads Mozilla's security team, said Spiegelmock admitted to the company that the presentation was meant to be humorous, and he and Wbeelsoi had not actually achieved remote execution with the exploit code demonstrated at the show. "At best, in some cases it will crash only the client," Snyder said Tuesday. "That's all we've been able to verify at this point." Spiegelmock, who works for Six Apart Ltd., confirmed as much in his LiveJournal blog, in which he includes a link to a statement he made that is posted on Snyder's Mozilla blog. (http://developer.mozilla.org/devnews/index.php/2006/10/02/update-possible-vulnerability-reported-at-toorcon/) "The main purpose of our talk was to be humorous," according to the statement. "As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has." During the presentation, the hackers also said they knew of 30 other vulnerabilities in Firefox but this, too, was a joke, Snyder said Tuesday. To hear Six Apart spokeswoman Jane Anderson tell it, the Toorcon presentation was a joke invented by two kids barely out of their teens who didn't understand the ramifications of their actions. "It was all a parody," she said. Anderson added that Spiegelmock was not representing Six Apart at the show, and the company spent most of Sunday on the phone with Mozilla putting out fires and cooperating with the company to get to the bottom of the matter. To make matters more embarrassing for Six Apart, the company's earliest investor, Joi Ito, is on Mozilla's board of directors. Anderson added that Spiegelmock will not be terminated for his actions. "We all make mistakes," she said. Snyder and the Mozilla team also are being good sports about the ordeal. "Of course, we always prefer that security researchers report vulnerabilities to us so we can create a patch before customers are put at risk," she said. "But at this point he's been very cooperative and we're pleased he's chosen to work with us." Still, Snyder said, "I know people who were working really hard here on Sunday probably have other things they'd rather be doing."
327980
Security firms have reported three new security flaws in various versions of the Mozilla and Firefox Web browsers and Mozilla's Thunderbird e-mail client.
769056
New software addresses a vulnerability that allowed previous versions to crash and execute arbitrary code.
509091
JavaScript development goes to the dogs What you can - and cannot do - with your software is often determined by the code owner's license. From not using open source APIs with closed-source digital rights management (DRM) to being barred from fiddling with Windows source code, we've seen it all.â¦Learn &amp; Contribute, Live &amp; Online - The Register Debates Green Computing
42492
As expected, Mozilla Corp. has released an update to Firefox that eliminates 11 vulnerabilities, including four ranked as "critical" by the software developer.
572892
Four new unpatched vulnerabilities have been published for Internet Explorer and Firefox, with two coming for each browser.
712878
Mozilla has released a critical security update to Firefox, taking a third shot at patching bugs in the way the browser can be used to launch programs from Web links.The bug, rated &quot;moderate&quot; by Mozilla, lies in the URI (Uniform Resource Identifier) protocol handling technology that is used to launch programs -- an e-mail client for example -- from within the browser. Over the past few months, security researchers have been discovering an increasing number of ways that this technology can be misused, often as a way to install unauthorized software on a victim&#39;s computer.The URI patch is one of eight security bug-fixes that Mozilla has pushed out with the 2.0.0.8 update, released late Thursday.Mozilla developers originally thought that the issue lay within Microsoft&#39;s Internet Explorer software, which could be invoked in a malicious fashion via Firefox. Several days after issuing their first patch, however, they realized that there was a problem with Firefox as well, and rushed out the 2.0.0.6 update.Now, three months after that fix, they&#39;ve patched another URI bug in Firefox that will cut down on the likelihood of programs being launched maliciously through the browser. The 2.0.0.6 release &quot;did not prevent the incorrect file-handling programs from launching which left some risk,&quot; Mozilla said in its advisory . &quot;An additional fix has been applied to Firefox 2.0.0.8 that detects when Windows would mishandle these URIs so that the wrong program does not get launched.&quot;Mozilla developers weren&#39;t certain that this latest twist on the URI problem could really be exploited in Firefox, but they decided to issue this latest URI patch rather than wait to find out for certain, said Window Snyder, Mozilla&#39;s security chief. &quot;We could just say this particular vector is not an issue because we do not have proof,&quot; she said. &quot;We could leave it alone. Rather than spend our time analyzing whether this is a vector that could be vulnerable, we would rather put the block in place and eliminate the possibility. This is a defense-in-depth measure.&quot;Microsoft has said that it plans to patch underlying components in the Windows operating system in an effort to prevent URI protocol handler attacks, and that will probably go a long way in preventing new attacks from cropping up, said Andrew Storms, director of security operations, with nCircle Network Security. &quot;We have to applaud the Mozilla team for attempting to protect their users, but in the end, it&#39;s going to be a Microsoft responsibility,&quot; he said.Of the eight vulnerabilities patched Thursday, two are rated critical by Mozilla.The 2.0.0.8 release also adds support for Apple&#39;s Mac OS X 10.5 operating system, code-named Leopard, although Mozilla warns &quot;there are some known issues affecting some media plugins,&quot; on this platform.
188255
Pass the parcel bug binned Mozilla has pushed out a new version of Firefox that fixes a number of security bugs, including a high-profile bug involving launching Firefox from Internet Explorer.â¦
92460
On Tuesday, the Mozilla Foundation released its first preview release of Firefox 1.0, the organization&#39;s standalone Web browser based on the Mozilla source code.