Mozilla on Wednesday patched 11 vulnerabilities in Firefox 3.0 -- and 12 bugs in the older Firefox 2.0 -- that could be used to compromise computers and steal information.
Wednesday's update patched virtually the same number of vulnerabilities as the last security upgrade seven weeks ago.
[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
Firefox 3.0.4, the fourth update since Mozilla launched the browser in June, fixes six flaws marked "critical," two "high," two "moderate," and one "low" in Mozilla's four-step scoring system. Most of the critical bugs could be used by hackers to introduce their own malicious code into a vulnerable system.
Among the most serious were a trio of vulnerabilities in the browser's layout and JavaScript engines, while others included a buffer overflow bug in the HTTP index format parser and another flaw -- pegged as moderate -- in the file: protocol handler. Mozilla repeatedly patched protocol handler bugs in Firefox starting in July 2007.
That vulnerability was judged moderate by Mozilla because of extenuating circumstances. "It requires an attacker to have malicious code saved locally, then have a user open a chrome: document or privileged about: URI, and then open the malicious file in the same privileged tab," Mozilla said in its advisory.
Mozilla also updated the nearly retired Firefox to 2.0.0.18, patching all but two of the same vulnerabilities fixed in 3.0.4, and several others for good measure. Of the dozen bugs, six were rated critical. The 2.0.0.18 update will be the next-to-last for the older Firefox 2.0, which will be dropped from support next month.
Before that happens, Mozilla will make one last effort to convince Firefox 2.0 users to upgrade. In two to three weeks, users will again be prompted to upgrade in a repeat of an offer first extended in August. Mozilla has been very successful in convincing users to upgrade; as of the end of October, 73 percent of users were running the newer Firefox 3.0, reported Web metrics firm Net Applications.
Not updated on Wednesday was Thunderbird, which remains at version 2.0.0.17. It's not unusual for the e-mail client to lag behind Firefox in patching vulnerabilities; as in the past, several of the issues in Firefox are also present in Thunderbird. Because the most dangerous of the six shared vulnerabilities are in various elements of the browser's JavaScript support, Thunderbird users can protect themselves in the interim by disabling JavaScript.
At times, the gap between Firefox and Thunderbird patches has been more than a month. This time, however, Thunderbird should be updated soon; version 2.0.0.18 entered beta test Wednesday.
Users can download the update for Windows, Mac OS X and Linux from the Mozilla site, call up their browser's built-in updater or wait for the automatic update notification, which typically appears within 48 hours.
Computerworld is an InfoWorld affiliate.
This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.
Download now »
Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.
Download now »
The emergence of WLANs has created a new breed of security threats to enterprise networks.
Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation
Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.
Download now »
Sign up to receive Security Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »
Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »
Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »
Recommend This
