Mozilla patches critical Firefox flaws

And it warns Firefox 2.0 users that bugs in older browser won't be fixed.

Mozilla Corp. has patched seven security vulnerabilities in Firefox, two of them labeled "critical," in the browser's first update for 2009.

Firefox 3.0.6 fixes about half the number of bugs that Mozilla quashed in December with the previous security update.

Of the seven flaws, two were rated "critical," by Mozilla, two "high," one "moderate" and two "low" in the company's four-step scoring system. Both of the critical vulnerabilities may have significant exploit potential, Mozilla said.

"Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort, at least some of these could be exploited to run arbitrary code," the company's advisory read. If so, hackers could use the bugs to crash the browser, then introduce their own malicious code into a vulnerable system, or both.

Other patches plugged a cross-site scripting hole -- a type of bug often used by identity thieves -- and another flaw that could be exploited to steal data from Web forms.

One of the seven patches was a second attempt to fix a problem first addressed in a November 2008 update. Although Mozilla rated the bug as moderate, the second-lowest in its scale, it said the vulnerability "could potentially be used by an attacker to inject arbitrary code," a description usually reserved for critical flaws. Mozilla justified the lower ranking by saying that any attack "has relatively high complexity."

Mozilla also warned users of the older Firefox 2.0 that their browser is vulnerable to some of the bugs patched in Version 3.0, although it didn't get into specifics. "If you're still using Firefox 2.0.0.x, this version is no longer supported and contains known security vulnerabilities," said Samuel Sidler, a Mozilla engineer, in a post to the "mozilla.dev.planning" message group Tuesday.

Firefox 2.0 was retired from support in mid-December. Since then, Mozilla has made a third and final attempt to get Firefox 2.0 users to update to the newer Firefox 3.0, and warned users that Google has shut off antiphishing protection in the former.

According to the latest data from Web metrics company Net Applications, Firefox 2.0 accounts for about 13% of Firefox's market share.

Not surprisingly, Mozilla Messaging's Thunderbird e-mail client, which uses the Firefox engine, primarily for JavaScript rendering, was not patched yesterday. It remains at Version 2.0.0.19, a late December update. Until Thunderbird catches up -- an update is currently being tested -- users can protect themselves against the two related Firefox vulnerabilities by disabling JavaScript in the e-mail program.

The new version of Firefox can be downloaded for Windows, Mac OS X and Linux from the Mozilla site. Current users can also call up their browser's built-in updater, or wait for the automatic update notification, which should pop up in the next 48 hours.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Firefox

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?