'Highly Critical' Flaw in Firefox 2.0
638921
Security firm Secunia has issued an advisory regarding a newly discovered "highly critical" security flaw in Firefox 2.0 and later, which involves a special URI handler. Although the problem was initially attributed to Internet Explorer by researcher Thor Larholm, Firefox is the culprit.
444532
Ten security flaws found in Firefox browser, Thunderbird e-mail client.
562962
(InfoWorld) - The Mozilla Foundation has published a fix for a "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite. The fix, released Monday, targets Firefox versions 2.0.0.2 and 1.5.0.10, as well as SeaMonkey versions 1.1.1 and 1.0.8. An earlier fix for a JavaScript problem allowed scripts from Web content to execute arbitrary code, the Mozilla Foundation said in a security update. The vulnerability allowed uniform resource identifiers in image tags to be executed even if JavaScript was disabled in the program preferences, Mozilla said. Disabling JavaScript does not protect against the flaw, so the foundation recommended that users upgrade the applications to new versions. Mozilla's Thunderbird e-mail client was not affected by the vulnerability, it said. The fix comes on the heels ofÂ criticism from independent security researcher Michael Zalewski regarding Firefox vulnerabilities, including spoofing and phising threats aimed at the newly released Firefox version 2.0.0.2. Mozilla CSO Window SnyderÂ saidÂ she is seeing more customer feedback regarding browser security and hopes thatÂ more independent researchers and customer feedback will help the company patch flaws more quickly. "The browser is one of most critical pieces of software on the computer in terms of something attackers are going after," Snyder said. "Attacks are constantly changing and every software developer needs to recognize new threats as they emerge, but that's nothing new, we've always considered security to be a top priority." Matt Hines, a senior writer at InfoWorld, contributed to this report
174787
The Mozilla Foundation celebrated the worldwide release of Firefox 1.0 Tuesday as new Mydoom variants exploited yet another Internet Explorer vulnerability.
420080
An update to Firefox fixes a number of security flaws in the browser.
445454
Mozilla chief security officer says Firefox has the same flaw that the company called a "critical vulnerability" in IE, patch is in the works.
281798
Before the sun set on Microsoft&#39;s Patch Tuesday this month, security firm Secunia discovered a vulnerability in Firefox that malicious hackers could exploit to compromise a user&#39;s system. Here&#39;s the catch: Exploiting the bug depends on interaction between Mozilla&#39;s browser and Microsoft&#39;s Internet Explorer.
260192
Mozilla will patch a security bug in Firefox that could be attacked in Internet Explorer.
44372
A flaw in the way the Firefox and Opera browsers handle an image file could allow an attacker to see what Web sites a person has visited.
273091
Security experts are warning of a new and highly critical security flaw in Microsoft (Nasdaq: MSFT) Internet Explorer, when running under Windows XP SP2.
752790
The latest beta release from Firefox fixes more than 900 hundred bugs and 300 memory leaks, and improves performance overall. It shows the open-source browser is on track to be one of the biggest releases of the new year.
7483
Every time a new IE security flaw is announced, or whenever someone gets fed up with hackers manipulating their Web browser, Firefox and other Mozilla-based browsers get a bump in the marketplace.
758734
(InfoWorld) - Mozilla has fixed a critical bug in the way the Firefox browser works with QuickTime media files. The flaw, which was reported last week by hacker Petko Petkov, gives attackers a way to run unauthorized commands on a victim's PC. "This could be used to install malware, steal local data, or otherwise corrupt the victim's computer," Mozilla said in a security advisory published Tuesday. A July 2007 patch was supposed to take care of this type of problem, but Petkov showed how attackers could still run commands on a victim's system by tricking a victim into opening a maliciously coded QuickTime media file. In fact, until Apple addresses the underlying flaw in QuickTime, there still could be headaches for users, Mozilla said in its security advisory on the issue. "QuickTime Media-link files could still be used to annoy users with popup windows and dialogs until this issue is fixed in QuickTime," the advisory states. The common security measure of disabling JavaScript does not prevent this attack, although the NoScript Firefox add-on does provide protection, Mozilla said. "Petkov provided proof of concept code that may be easily converted into an exploit, so users should consider this a very serious issue," Mozilla's security chief, Window Snyder said in a recent blog posting. Mozilla has been able to reproduce this bug only on the Windows operating system, she added. The flaw also affects the Internet Explorer browser, Petkov said on his blog. However, IE's security policies make the flaw less critical on Microsoft's browser, he added. The Firefox 2.0.0.7 update was pushed out to users starting around 3 p.m. Pacific Time on Tuesday. It contains only one security update: the QuickTime fix.
79115
The Mozilla Foundation&#39;s Firefox stand-alone browser, which has been riding a wave of defectors from the security-plagued Internet Explorer, has a bug of its own, the open-source group recently announced.
753365
(InfoWorld) - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update. No, that's not a typo, just the strange fall-out from an unusual bug that had security researchers debating the question this week, "Who's to blame? Microsoft or Mozilla?" Security researcher Thor LarholmÂ kicked off the controversy on Tuesday, claiming that he had discovered a flaw that would let an attacker run commands on a victim's PC. In his blog posting, Larholm said the bug was similar to a flaw he'd discovered last month in Apple's Safari 3.0 beta software, and he called it an an "input validation flaw in Internet Explorer." The problem is with a URL protocol handler component of Internet Explorer, he said. This software allows Internet Explorer users to launch applications such as Excel or Firefox by clicking on specially written links on Web pages. When Internet Explorer clicks on a link that launches the Firefox browser, however, the software does not properly check its syntax, and that, Larholm said, lets an attacker create a malicious link, that could be used in an attack. Security vendor Secunia ApS rates the flaw as "highly critical." So while the flaw affects Internet Explorer users, it appears to be a risk only to those who already have Firefox installed. And to make matters more complicated, if a Firefox user were to click on one of the specially written links, he would not be affected. Still, Microsoft Security Program Manager Mark Griesi said that the bug was not his company's problem. "We don't feel that there's an issue in IE and therefore there's nothing to be fixed," he said Tuesday. With Microsoft saying it won't fix the vulnerability, Mozilla said it would change the way its Firefox URL protocol handler worked in its next Firefox update. That will fix Larholm's bug, but Mozilla security strategist Window Snyder wouldn't say whether or not she considered the vulnerability to be an IE or Firefox problem. She did, however, point out that without Microsoft making changes to IE, other Windows programs may be at risk. Noted browser bug-hunter Aviv Raff wrote in his blog that he thought both Microsoft and Mozilla were to blame. But another security expert said that the responsibility to fix the problem lies with the open-source browser developers. "This is an oversight in how Mozilla decided to construct their protocol registration, and how they do input validation between this handler and their application," said Eric Schultze, chief security architect with Shavlik Technologies, via e-mail. "I think Mozilla needs to write and release a patch for this issue and Microsoft can take the week off."
69359
PC Magazine - A public claim by hackers that Mozilla's Firefox browser is vulnerable to multiple code execution vulnerabilities may be a joke gone awry.
104614
The Mozilla Project has issued a warning for a series of &quot;highly critical&quot; security holes in three of its core projects, including its flagship Firefox Web browser and the Thunderbird e-mail client.