Firefox patches elusive QuickTime security flaw
69508
Previous patches have been exploited forcing Mozilla to issue another, hopefully, final patch.
727620
A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla Corp. said it plans to patch the problem in its next Firefox software update.
450858
New vulnerabilities include a critical flaw in Internet Explorer and a "major" bug in Firefox.
725728
InfoWorld - The Mozilla Foundation has published a fix for a &quot;critical&quot; JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
576682
A year-old QuickTime bug that hackers to hijack PCs and Macs with Firefox installed,  has Mozilla Corp. scrambling for a fix, according to Mozilla's chief security officer.
172224
Firefox remains vulnerable to attacks exploiting protocol-handling bugs, even with two recent patches, security researchers say.
415939
Add-ons add security threat A security weakness in the update mechanism for third-party add-ons to the Firefox browser could give an attacker the ability to exploit unsecured downloads and install malicious code on the victim's computer, a security researcher warned on Wednesday.â¦
495234
Apple has released a new security patch for QuickTime, its eighth update this year for the media player software.
241440
Blog: Patches include the Firefox portion of the IE-Firefox flaw identified last week.
340873
Mozilla Corp. has released a critical security update to Firefox, taking a third shot at patching bugs in the way the browser can be used to launch programs from Web links.
562962
(InfoWorld) - The Mozilla Foundation has published a fix for a "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite. The fix, released Monday, targets Firefox versions 2.0.0.2 and 1.5.0.10, as well as SeaMonkey versions 1.1.1 and 1.0.8. An earlier fix for a JavaScript problem allowed scripts from Web content to execute arbitrary code, the Mozilla Foundation said in a security update. The vulnerability allowed uniform resource identifiers in image tags to be executed even if JavaScript was disabled in the program preferences, Mozilla said. Disabling JavaScript does not protect against the flaw, so the foundation recommended that users upgrade the applications to new versions. Mozilla's Thunderbird e-mail client was not affected by the vulnerability, it said. The fix comes on the heels ofÂ criticism from independent security researcher Michael Zalewski regarding Firefox vulnerabilities, including spoofing and phising threats aimed at the newly released Firefox version 2.0.0.2. Mozilla CSO Window SnyderÂ saidÂ she is seeing more customer feedback regarding browser security and hopes thatÂ more independent researchers and customer feedback will help the company patch flaws more quickly. "The browser is one of most critical pieces of software on the computer in terms of something attackers are going after," Snyder said. "Attacks are constantly changing and every software developer needs to recognize new threats as they emerge, but that's nothing new, we've always considered security to be a top priority." Matt Hines, a senior writer at InfoWorld, contributed to this report
302277
Both Windows and Mac versions of the multimedia program have a buffer overflow flaw that puts users at risk.
115827
Blog: Critical security flaw found in Firefox 2.0 and later versions potentially puts users' systems at risk of a remote attack.
588549
Apple released an update to its QuickTime media player on Friday, patching eight security flaws in the application including code execution and information disclosure risks. Both Mac OS X and Windows are affected.
99286
THE MOZILLA FOUNDATION has announced that a hole in its Firefox software has been patched. Firefox suffers from a vulnerability that could allow hackers to delete all the files in the Download directory.
369010
(InfoWorld) - Mozilla patched its flagship Firefox browser Thursday with fixes for six vulnerabilities, one of which was stamped "critical" by the open-source developer. This was the third time Mozilla has updated Firefox in 2007. The updates bring the current browser to Version 2.0.0.4 and the 2005 edition to 1.5.0.12. MFSA 2007-12, the most serious of the six, patched 30 separate memory corruption bugs in the browser layout and JavaScript engines. Even Mozilla seemed unsure of their impact. "Some of these crashes showed evidence of memory corruption under certain circumstances, and we presume that with enough effort, at least some of these could be exploited to run arbitrary code," the advisory read. Mozilla warned Thunderbird and SeaMonkey that their e-mail software, which shares Firefox's layout engine, may be vulnerable to these bugs as well. The developers recommend that users do not enable JavaScript in Thunderbird or the mail portion of SeaMonkey. The updates also fix a pop-up bug that could be used to mask parts of the browser, such as the address bar; a cross-site scripting vulnerability; a problem with how the browsers handle cookies; and a flaw that could let attackers crash Firefox using its autocomplete feature. Firefox 2.0.0.4 can be downloaded from the Mozilla Web site for Windows, Mac OS X, and Linux; Firefox 1.5.0.12, meanwhile, is available from a different page. Current users can also update using the Check for Updates command in the help menu. Mozilla also reiterated that Thursday's patches would be Firefox 1.5's last and said that an update to Firefox 2.0.0.4 would be offered to its users "over the coming weeks." Although Firefox ended 2006 on an upbeat security note according to Symantec -- the anti-virus vendor tallied 40 patches in the last six months of the year, 26 percent fewer than the 54 released for rival browser Internet Explorer -- so far this year, Mozilla has addressed more than twice as many vulnerabilities as IE. In the first five months of 2007, 22 bugs in Firefox have been patched, nine of which were pegged as critical. Microsoft has fixed only eight in IE; seven were labeled critical.
655104
Apple has released a security fix for its QuickTime media player software, fixing a critical bug that had been worrying security experts for nearly a month.The update, released Wednesday, fixes a vulnerability in the RTSP (Real Time Streaming Protocol) used by QuickTime to handle streaming media.On Jan. 10, researcher Luigi Auriemma disclosed the flaw by posting proof-of-concept attack code that could be used to run unauthorized software on a victim&#39;s computer. For the attack to work, the criminal would have to first trick the user into viewing a maliciously encoded QuickTime media file.With the attack code available, security researchers had been hoping that Apple would address the flaw. Wednesday&#39;s QuickTime 7.4.1 update is for both the Mac OS X and Windows operating systems.It is Apple&#39;s fifth QuickTime update since October. The company has been forced to issue the flurry of patches as security researchers have taken a closer look at media player flaws during the past year. In December, Apple patched a separate RTSP vulnerability, which online criminals had already started to use in their attacks.&quot;In the past few months, QuickTime has been a prevalent target for security researchers,&quot; said Andrew Storms, director of security operations with nCircle Network Security. &quot;Internet media applications on the desktop have been a rich target for attackers, and this trend is sure to continue as most users aren&#39;t yet accustomed to attacks arriving in the form of a viral video.&quot;