Mozilla patches 11 Firefox bugs, six critical
Plugs SSL hole reported by Microsoft researchers
Computerworld - Mozilla on Thursday patched 11 vulnerabilities in Firefox, more than half of them labeled "critical."
The update was the first since late April, when Mozilla rushed out a refresh to plug a hole that the company's developers has inadvertently introduced in the Windows version of the browser, and came just days after the launching of a "tweener" build of the upcoming Firefox 3.5.
Of the 11 flaws fixed in Firefox 3.0.11, six were rated critical, one "high," two "moderate" and two "low" in Mozilla's four-step system.
The SSL tampering vulnerability was reported to Mozilla by three researchers working for browser rival Microsoft, and a fourth at Purdue University. The four -- Shuo Chen, Ziqing Mao, Yi-Min Wang and Ming Zhang -- co-wrote a paper titled "Pretty-Bad-Proxy: An Overlooked Adversary in Browsers' HTTPS Deployments," that they published May 1 (download PDF). Mozilla ranked the vulnerability as "high."
Thursday's update was the fifth this year for Firefox 3.x, but not the first for Mozilla's browsers this week.
On Monday, Mozilla rolled out Firefox 3.5 Preview, a build the company said is a near-finished version of the official Release Candidate, or RC. Although new-found bugs had delayed the RC's release yet again, Mozilla wanted to get something in testers' hands, and so took the unusual step of delivering the Preview.
At this point, Mozilla has not set a scheduled for posting Firefox 3.5 RC, once slated to appear the first week of June. In notes on a status meeting the company held Wednesday, Mozilla simply noted that it would release the RC "you know, when it's ready."
Firefox 3.5 Preview is being offered only to users who have already installed Beta 4 of the browser upgrade.
Firefox 3.0.11 can be downloaded for Windows, Mac OS X and Linux, but current users can also call up their browser's built-in updater or wait for the automatic update notification, which should pop up in the next 48 hours.
Read more about Security in Computerworld's Security Topic Center.
- Securing Mobile App Data - Comparing Containers and App Wrappers Analysts agree that Mobile Device Management (MDM) is not enough when it comes to securing app data. Although it remains a critical component...
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!