We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

Firefox 3.0 security release patches 11 flaws

Firefox 3.0.4 released this week

Mozilla has released a security update to patch 11 flaws in Firefox 3.0 and 12 bugs in its older browser Firefox 2.0.

This release patched virtually the same number of vulnerabilities as the last security upgrade seven weeks ago.

Firefox 3.0.4, the fourth update since Mozilla launched the browser in June, fixes six flaws marked 'critical', two 'high', two 'moderate', and one 'low' in Mozilla's four-step scoring system. Most of the critical bugs could be used by hackers to introduce their own malicious code into a vulnerable system.

Among the most serious were a trio of vulnerabilities in the browser's layout and JavaScript engines, while others included a buffer overflow bug in the HTTP index format parser and another flaw - pegged as moderate - in the file: protocol handler.

Mozilla repeatedly patched protocol handler bugs in Firefox starting in July 2007. That vulnerability was judged moderate by Mozilla because of extenuating circumstances.

"It requires an attacker to have malicious code saved locally, then have a user open a chrome: document or privileged about: URI, and then open the malicious file in the same privileged tab," Mozilla said in its advisory.

Mozilla also updated the nearly-retired Firefox to 2.0.0.18, patching all but two of the same vulnerabilities fixed in 3.0.4, and several others for good measure. Of the dozen bugs, six were rated critical. The 2.0.0.18 update will be the next-to-last for the older Firefox 2.0, which will be dropped from support next month.

Before that happens, Mozilla will make one last effort to convince Firefox 2.0 users to upgrade. In two to three weeks users will again be prompted to upgrade in a repeat of an offer first extended in August. Mozilla has been very successful in convincing users to upgrade; as of the end of October, 73 percent of users were running the newer Firefox 3.0, reported web metrics firm Net Applications.

Mozilla's email client Thunderbird, which remains at version 2.0.0.17, was updated in the security release. It's not unusual for the email client to lag behind Firefox in patching vulnerabilities; as in the past, several of the issues in Firefox are also present in Thunderbird. Because the most dangerous of the six shared vulnerabilities are in various elements of the browser's JavaScript support, Thunderbird users can protect themselves in the interim by disabling JavaScript.

At times, the gap between Firefox and Thunderbird patches has been more than a month. This time, however, Thunderbird should be updated soon; version 2.0.0.18 entered beta test this week.

Users can download the update for Windows, Mac OS X and Linux from the Mozilla site, call up their browser's built-in updater or wait for the automatic update notification, which typically appears within 48 hours.

Visit Security Advisor for the latest internet threat news, FREE net threat email newsletters, and internet security product reviews

Visit Broadband Advisor for the latest internet news, reviews, tips & tricks - and to take advantage of PC Advisor's unique, independent Broadband Speed Tester

Computerworld


IDG UK Sites

Samsung Galaxy S6 launch as it happened: Galaxy S6 launch video and live blog - watch again as...

IDG UK Sites

5 things we hate about MWC: What it's like to be a journalist at a technology trade show

IDG UK Sites

Interview: Lauren Currie aims to help design students bridge skills gap

IDG UK Sites

12in Retina MacBook Air release date rumours: new MacBook Air to have fingerprint ID, could launch...