File Deletion Flaw In Firefox Fixed
79115
The Mozilla Foundation&#39;s Firefox stand-alone browser, which has been riding a wave of defectors from the security-plagued Internet Explorer, has a bug of its own, the open-source group recently announced.
29646
Users of Firefox yesterday began receiving notices of the availability of version 2.0.0.7, which the Mozilla organization said addresses a vulnerability involving Apple's QuickTime plug-in. In BetaNews tests of the new version this afternoon, the vulnerability in question appears to have been fully patched.
450858
New vulnerabilities include a critical flaw in Internet Explorer and a "major" bug in Firefox.
260192
Mozilla will patch a security bug in Firefox that could be attacked in Internet Explorer.
444532
Ten security flaws found in Firefox browser, Thunderbird e-mail client.
336569
A security issue has been discovered in a common feature included in several Web browsers, including Mozilla, Firefox, Opera, Konqueror and Camino.
94093
An intruder could manipulate a flaw in how the browsers handle image files to see where the user has been surfing.
696978
The update for the Mozilla browser fixes an unusual vulnerability that could cause malicious code to run if the browser is launched by Microsoft's IE.
752790
The latest beta release from Firefox fixes more than 900 hundred bugs and 300 memory leaks, and improves performance overall. It shows the open-source browser is on track to be one of the biggest releases of the new year.
87335
(InfoWorld) - A flaw in Mozilla Corp.'s Firefox browser makes it easy for cybercriminals to steal user information on Web sites where users create their own pages, such as MySpace.com. The flaw lies in Firefox's Password Manager software, which can be tricked into sending password information to an attacker's Web site, said Robert Chapin, president of Chapin Information Services Inc. For this attack to work, attackers need to be able to create HTML (Hypertext Markup Language) forms on the Web site, something that is allowed on blogging and social networking sites. The attack was used in aÂ MySpace phishing attack reported in late October. In that attack, users registered a MySpace account named login_home_index_html and used it to host a fake log-in page that exploited the flaw. This page sent MySpace username and password information to another Web site, and MySpace users who visited the page using Firefox could have easily had their information compromised, said Chapin. Firefox developers rate this bug critical, according to an entry in the project's Bugzilla database. The flaw arises because Firefox's Password Manager does not perform a thorough enough check when it is deciding whether to send password information, and then does not ensure that password information is being sent to the server that requested it, Chapin said. In the MySpace attack, for example, Firefox would check to see if the form was coming from the MySpace.com domain, but did not make sure that the password information was being sent back to a MySpace server. "From a programming point of view, this is almost like a typo," he said. "Ironically I think that's why it hasn't been discovered until now. It was just way too obvious." Chapin has posted an analysis of this type of attack, which he has dubbed a Reverse Cross-Site Request, as well as a demonstration of how it works . Microsoft Corp.'s Internet Explorer (IE) is also susceptible to these type of attacks because, like Firefox, it does not ensure that password information is being sent to the same server that requests it, Chapin said. But IE is less likely to be tricked because it does a more thorough job in checking to see where the log-in form is coming from before it automatically submits password and user information, he added. Â
93571
A zero-day flaw in Firefox and third-party Windows patches turn up the heat for Net users. Plus: Buyout boom in security.
2920
A Firefox 'flaw' revealed at a hacker conference over the weekend was a joke, hacker admits.
23136
The hacker who discovered a recently patched QuickTime flaw affecting the Firefox browser says he has found an equally serious flaw in Adobe Systems Inc.&#39;s PDF file format.
115827
Blog: Critical security flaw found in Firefox 2.0 and later versions potentially puts users' systems at risk of a remote attack.
516374
Adobe today patched its Reader and Acrobat programs to fix a flaw involving malicious PDF files.
284652
Makes a change from IE Critical flaws in the way Firefox handles JavaScript code create a possible means for hackers to commandeer vulnerable PCs, according to security researchers.â¦
86222
In brief Exploit circulating for unpatched vuln