Mozilla fixes 11 new flaws in Firefox, six critical
It also patches Firefox 2.0; just one more update coming for older browser
Yesterday's update patched virtually the same number of vulnerabilities as the last security update seven weeks ago.
Firefox 3.0.4, the fourth update since Mozilla launched the browser in June, fixes six flaws rated "critical," two "high," two "moderate," and one "low" in Mozilla's four-step scoring system. Most of the critical bugs could be used by hackers to introduce their own malicious code into a vulnerable system.
That vulnerability was judged moderate by Mozilla because of extenuating circumstances. "It requires an attacker to have malicious code saved locally, then have a user open a chrome: document or privileged about: URI, and then open the malicious file in the same privileged tab," Mozilla said in its advisory.
Mozilla also updated the nearly retired Firefox to 220.127.116.11, patching all but two of the same vulnerabilities fixed in 3.0.4 and several others for good measure. Of the dozen bugs, six were rated critical. The 18.104.22.168 update will be the next-to-the-last one for the older Firefox 2.0, which will be dropped from support next month.
Before that happens, Mozilla will make one last effort to convince Firefox 2.0 users to upgrade. In two to three weeks, users will again be prompted to upgrade in a repeat of an offer first extended in August. Mozilla has been very successful in convincing users to upgrade; as of the end of October, 73% of users were running the newer Firefox 3.0, reported Web metrics firm Net Applications.
At times, the gap between Firefox and Thunderbird patches has been more than a month. This time, however, Thunderbird should be updated soon; Version 22.214.171.124 entered beta testing yesterday.
Users can download the update for Windows, Mac OS X and Linux from the Mozilla site, call up their browser's built-in updater or wait for the automatic update notification, which typically appears within 48 hours.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Benefits of IBM: The Savings of Open Source Download Now
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Open Source White Papers | Webcasts