Mozilla patches Firefox, but leaves some flaws unfixed
Although 14 vulnerabilities were fixed, several more remain....

February 23, 2007 (Computerworld) -- Mozilla Corp. updated Firefox Friday to patch 14 vulnerabilities, three of them critical, but pushed out the new versions without fixing several flaws.

Firefox 2.0.0.2 and Firefox 1.5.0.10, which originally were to release on Wednesday, were delayed to patch a series of bugs, including some disclosed this month by Polish researcher Michal Zelewski. Two others forwarded to Mozilla developers by Zelewski, however, didn't make it into today's updates.

"Neither of those will make this release," said Daniel Veditz, of the Mozilla security in an e-mail. "It is important that we get the security fixes we have into the HANDS of our users."

Of the bugs filed by Zelewski but not fixed in the updates, the most serious is a memory corruption flaw that could let attackers inject code remotely into Firefox-equipped machines simply by duping users into visiting a malicious Web page. "Firefox is susceptible to a seemingly pretty nasty, and apparently easily exploitable, memory corruption vulnerability," wrote Zelewski in the Bugzilla database.

Security vendor Symantec Corp. agreed. "Successfully exploiting this issue may allow remote attackers to execute arbitrary machine code in the context of the affected application. This could facilitate the remote compromise of affected COMPUTERS," it reported in an alert sent to subscribers to its DeepSight threat system. US-CERT, the federally funded vulnerability monitoring center, also issued a warning today, and recommended that Firefox users disable JavaScript.

Also unrepaired in the latest browser versions is a third Zelewski-discovered bug that could give cybercriminals a LEG up when running phishing attacks.

Mozilla spelled out the security fixes in Firefox 2.0.0.2 and 1.5.0.10 here.

Firefox 1.5.0.10 is nearly at the end of its supported lifespan. After April 24, Mozilla will stop issuing security and stability updates to that edition.

Firefox 2.0.0.2 can be downloaded from the Mozilla Web site in versions for Windows, Mac OS X and Linux in 36 languages. Users can also update current editions with the Check for Updates command in the Help menu. (personal note*) [highlight]Having SWITCHED over to Firefox approx: 5 months ago,> the virus / trojan attacts on my puter have dropped off VERY- significantly!! Almost non anymore.
I love this browser*[/highlight]
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=software&articleId=9011721&taxonomyId=18&intsrc=kc_topThanks for that, I really didn't know about 2.0.0.2.
Upgrading now, thanks.well.. some of the forum functions do not work due to the fact i no longer have java enabled.. but.. bleh, who needs java..?I need Java, I write programs in that LANGUAGE every day.Quote

I need Java, I write programs in that language every day.

Quote

I need Java, I write programs in that language every day.

well.. java would be nice.. although not the program.. i need me some caffene..