Mozilla patches 9 Firefox bugs, adds plug-in crash protection
Ships delayed Firefox 3.6.4 with new feature that keeps Windows, Linux browsers running when Flash, QuickTime or Silverlight go south
Computerworld - Mozilla on Tuesday patched nine vulnerabilities, six of them critical, in Firefox 3.6 and Firefox 3.5.
But rather than highlighting the security fixes in Firefox 3.6.4, the company instead emphasized the addition of crash protection, a move meant to keep the browser alive when popular plug-ins drop dead.
Updates to Firefox 3.6.4 and Firefox 3.5.10 fixed nine flaws for each version, although the total patch count came to 10 because two fixes affected only one of the pair.
Six of the nine vulnerabilities for each browser were rated "critical," Mozilla's highest threat ranking, indicating that hackers could use them to compromise a system running Firefox, then plant other malware on the machine.
Two were labeled "moderate," the second-lowest rating, while one was tagged as "low."
One of the critical flaws was reported to Mozilla by Nils, a German research who only goes by his first name.
Nils gained fame by winning cash prizes at the last two annual Pwn2Own hacking contests, sponsored by HP TippingPoint's Zero Day Initiative bug bounty program.
It was Nils' second Pwn2Own victory; last year he grabbed $15,000 by exploiting not only Firefox, but also Safari and IE8.
But Mozilla wanted all eyes on Firefox 3.6.4 for a different reason. "Results from our beta testing show Firefox 3.6.4 will significantly reduce the number of Firefox crashes experienced by users who are watching online videos or playing games," said Christian Legnitto, who oversees the Firefox releases, in a post to Mozilla's blog.
"When a plug-in crashes or freezes while using Firefox, users can enjoy uninterrupted browsing by simply refreshing the page," he said.
Firefox 3.6.4 currently recovers only from crashes of Adobe's Flash Player, Apple's QuickTime and Microsoft's Silverlight plug-ins, and is available only in Firefox for Windows and Linux. The company is still working on the feature, which it has dubbed "out of process plug-ins," or OOPP, for the Mac version.
Mozilla has had an eye on Flash for OOPP treatment because Adobe's software has been responsible for more Firefox crashes than any other plug-in, according to the company.
It has also worked other features into Firefox to deal with problems in that plug-in, and others. Last year, for example, Mozilla kicked off plug-in checking, a feature that determines whether a user is running an outdated, and possibly vulnerable, plug-in, by focusing on Flash.
A keystone of the "Lorenz" project -- a move by Mozilla to quickly add features to Firefox via regular security updates rather than waiting for bigger upgrades -- OOPP was designed as a stop-gap measure for Firefox 3.6 when work on the full-scale "Electrolysis" process separation project was shifted to Firefox 4, a major update currently scheduled to ship by the end of 2010.
The addition of OOPP led to several delays of Firefox 3.6.4, which at one point was slated for an early May release, then pushed to June 1 and beyond.
Mozilla has no plans to add OOPP to the older Firefox 3.5 line, it said in an FAQ on the new crash protection feature.
Users can update to Firefox 3.6.4 by downloading the new edition or by selecting "Check for Updates" from the Help menu in the browser. Firefox 3.5 can obtain the patches by calling up the integrated update tool.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
- Workarounds to purge search bar from Firefox's new tab page are available
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
Read more about Desktop Apps in Computerworld's Desktop Apps Topic Center.
- HTTP Status Code Cheat Sheet Look at the Graph, Find the Code and Boom - You're Solving Problems. Identifying and understanding common HTTP status codes can go a...
- Simple Solution, Big Capability Meet growing employee and business demands by connecting up to 1,000 users with powerful collaboration capabilities with a single, integrated platform -- Cisco...
- The Business Value of Continuous Delivery Download this whitepaper to learn more about the business value of Continuous Delivery and see why it could be a game changer for...
- Ten Factors Shaping the Future of Application Delivery Download this research report conducted by Enterprise Management Associates (EMA) to learn how those that are seeking to accelerate application delivery are leveraging...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Desktop Apps White Papers | Webcasts