|
|
Critical update for Firefox released
Author: Gareth HalfacreePublished: 19th December 2008
The latest update to Firefox - as well as Seamonkey and Thunderbird - fixes a raft of 'critical' security vulnerabilities.
According to CNet the new version, trickled out to users via the in-built automatic update functionality of the browser earlier this week, has been released to fix a series of security flaws described as 'highly critical' that exist in the 3.0.x series of Mozilla's Firefox, as well as the 1.1.x versions of SeaMonkey and the 2.0.0.x series of e-mail client Thunderbird, which shares HTML and JavaScript engines with its browser relatives.
The updates – which move the software on to versions 3.0.5, 1.1.14, and 2.0.0.19 respectively – fix three main security flaws: errors in the layout and JavaScript engine that can be used to corrupt memory and possibly execute a malicious payload; a problem with the processing of the 'persist' XUL attribute which can allow user identification across browser sessions regardless of the cookie preferences the user has set; and an exploitable condition which allows third-party sites to possibly access sensitive information and execute arbitrary JavaScript code under the privileges of the browser.
As usual, the security problems within the browser stem from the use of JavaScript. If a user enables an add-on such as NoScript – which selectively disables JavaScript on untrusted sites and introduces novel protections against cross-site scripting and clickjacking attacks – then the attacks are ineffectual unless being run from a previously trusted site.
While the recently exposed security hole in Internet Explorer has been getting a lot of attention, this latest patch to the popular open-source browser shows that it's difficult to provide a balance of flexibility and security in an application as powerful as a web browser.
Has anyone fallen victim to an attack from a site via the recent Internet Explorer or Firefox vulnerabilities, or is it just a case of the developers keeping things as tightly secured as possible despite a lack of real-world exploitation? Share your thoughts over in the forums.
Related
Comments (13)
Compare over 250 mobile phones &
52,000 deals!
Compare over 100 broadband & mobile broadband deals online!
- Site Links:
- About
- Email Editor
- Newsletter
- Privacy
- RSS
- Score Guide
- Our Other Websites:
- Auto Express
- Channel Pro
- Computer Buyer
- Computer Shopper
- Den of Geek
All content © bit-tech.net 2000-2009
© Copyright Dennis Publishing Limited licensed by Felden
Even the computers in uni which all use Firefox are afflicted by the same slowness and likelihood of crashing out, now that they use Firefox 3, while it wasn't so back when they used Firefox 2..
Has anyone else experienced or noticed this?
Nope, not at all. I'd get a few crashes with FF2, and some cases of slowdowns which I guess was down to memory leak, but none of that with the release of FF3.
im happy with Chrome actually..................... :p
Good night thats some serious browsing. I think the most tabs ive had open was 5 lol
Much better than IE, which crashes all the time. If I try to open a new tab after I've got 25 or so already, it will just not open. I have to close some to open another.
I'm discovering that FF really is no better than IE both in stability, performance and security. I do like some of FF's features better. The find feature is really wonderful.
But I in small part I use FF just to stick it to Microsoft.
For security reasons I now use both IE and FF. When critical unpatched vulnerabilities are discovered in FF I switch back to IE temporarily until FF is patches, then back to FF I go.
I'm downloading 3.0.5 right now
Strange...will have to update manually.