Shoutbox

Firefox has been hit by no less than eight security flaws, six of which are also found in the older Mozilla suite.

The vulnerabilities could allow an attacker to take over an affected system, carry out cross-site scripting and bypass some security restrictions, the Mozilla Foundation warned at the same time it released patches for the holes. Independent security firm Secunia gave the updates a "highly critical" rating.

As Firefox gains market share its handling of security issues is drawing more scrutiny. The patches, issued on Friday, are the third round of security fixes for Firefox and the seventh update for the 1.7 version of Mozilla. The Mozilla project has stopped major development on the suite, but is continuing to fix security flaws.

Two of the flaws affect Firefox only: an input validation error when processing the "pluginspage" attribute of the "embed" tag for plugins, which can be used to inject JavaScript code, and a bug in the sidebar that could allow cross-site scripting.

The remaining six bugs affect both browsers. Certain pop-ups can execute malicious code on a user's system, if the user opens the pop-up. A bug in the way windows and tabs are handled can allow malicious code from an untrusted site to execute in the context of another site. A bug involving the URLs of "favicons" icons allows JavaScript code to execute with escalated privileges.

A bug in installing search plugins can allow malicious code execution, but requires tricking the user to install a specially crafted search plug-in. Input validation errors in InstallTrigger and other XPInstall-related JavaScript objects could allow malicious code execution.

Finally, a problem with the "chrome" user-interface code in validating DOM nodes allowed several exploits that could allow malicious code execution or data theft, requiring only trivial user actions such as clicking on a link.

The updates, version 1.0.3 of Firefox and 1.7.7 of Mozilla, are available from the Firefox and Mozilla download pages. The project said a number of extensions were broken by the updates, but most extensions have now been revised to work with the new versions.



SOURCE:http://www.techworld.com/security/news/index.cfm?NewsID=3506

But these wernt "in the wild" like internet explorers they were all submitted using bugzilla and marked so only the developers can see them. also the people that discoverd these bugs could also claim money from mozilla's "bugs for cash" program which also trys to attract hackers attattion to find bugs in firefox.

quote:

---

Originally posted by -dt-
But these wernt "in the wild" like internet explorers they were all submitted using bugzilla and marked so only the developers can see them. also the people that discoverd these bugs could also claim money from mozilla's "bugs for cash" program which also trys to attract hackers attattion to find bugs in firefox.

---

Hmm bugs for cash. Interesting.
------

I got the update as soon as it came out so I'm fine

Ever since I upgraded to 1.0.3, I cant type anything into the address bar. I have to go to File>Open Location. Anyone else have this, or now how to solve it?

quote:

---

Originally posted by MeEtc
Ever since I upgraded to 1.0.3, I cant type anything into the address bar. I have to go to File>Open Location. Anyone else have this, or now how to solve it?

---

Have toy tried reinstalling it?

i uninstalled .2 first, installed .3, restarted the comp, but did not reinstall the second time. *will after exam is over...*

Maybe it's an extension you have installed that's causing the problem?

Anyway, I'm glad I'm not a Firefox fanboy . I don't use it because it's "more secure", I use it because of the features

I don't have any extentions installed
I use it for the features and speed. IE takes a while to load up on my comp

MeEtc,
Try posting on Firefox forum's.
http://forums.mozillazine.org/viewforum.php?f=38

They should know the answer