Recent Firefox update caused crashes, possible hole

By Ed Oswald | Published April 17, 2008, 10:57 AM

While there is no evidence of an exploit as of yet, Mozilla is taking a proactive measure to fix the issue before it could be.

A problem with stability which resulted in crashes and evidence of memory corruption was remedied in Firefox 2.0.0.13, however apparently the fix did not completely close any holes.

In fact, it seems as if it introduced new stability issues, where crashes occurred during JavaScript garbage collection. That feature allows a developer to reclaim the memory occupied by strings, objects, arrays, and functions that are no longer in use.

"We have no demonstration that this particular crash is exploitable but are issuing this advisory because some crashes of this type have been shown to be exploitable in the past," Mozilla said in an advisory.

Thunderbird is also affected, however JavaScript needs to be enabled. By default, this is not, and Mozilla said it discourages users from running scripts within mail.

JavaScript garbage collection problems have cropped up in the past. In February 2006, Mozilla addressed several issues within Firefox 1.5 which also posed a memory corruption and arbitrary code risks.

CLARIFICATION We made an adjustment to our headline for accuracy: The latest fix for Firefox 2, version 2.0.0.14, addresses the problem raised by the Mozilla advisory.

Comments

View comments by with a score of at least

I spoke too soon 2.0.0.14 is still causing garbage collector crashes in other apps for me.

Score: 0

|

Correct headline to say what your correction says, "Recent Firefox Update FIXES crashes and possible hole."
Those scanning headlines will get the wrong impression.
I've been using Firefox 3 beta5 as my default browser, and love it, now that AdBlock Plus is updated/supported. (I know that isn't about version 2, but this IS BETA news, isn't it?)

Score: 0

|

I will use FF3 as soon as possible. Tried 3.0 b3 once and it worked perfectly, perfectly, PERFECTLY. I love it.

Score: 0

|

Your headline is still unclear. Try again betanews.

Score: 0

|

I never had a problem in firefox with it but when 13 was running some other apps would crash with garbage collector errors when i tried running them - all fine now with 14.

Score: 0

|

strange, just updated from 13 to 14, and getting loads of crashes, tab lockups and weird freezing problem, went back to 2.0.0.13 and all good again,

Score: 0

|

Perfect is as perfect does, guess this browser is not so perfect. But I use it anyway along with a few others. We will have to live with error's and mistakes in the computer world no doubt until the end of time. Nothing is perfect and it probably never will be.... There is life beyond Firefox and any other software I guess....

Score: 0

|

All browser is the same. It's the users. Even if you give a bullet proof browser to morons, they will find way to break it.

I too use FF. Only reason I like it is I can customize the way I want it.

Score: 0

|

I used it even when I was under Windows.

Score: 0

|

Now he's just under a rock.

*rimshot*

Try the Veal, folks. ;)

Score: 0

|

From the advisory: "Fixed in Firefox 2.0.0.14"

What was the point of this article again?

Score: 0

|

Why, to generate hits from fanboys and trolls obviously. :p

Score: 0

|

Like you?

Score: 0

|

Actually, I was picturing *you* when I wrote that.

In your mind, Linux can do no wrong. It is perfect. That is the very definition of a fanboy.

...and while you may suffer under the delusion that I am a MSFT fanboy, I use Firefox, and have many times expressed my dislike of certain MSFT applications, operating systems, and actions, which most would see as something *other* than being a fanboy.

As for trolling, while I rarely provide an insight or viewpoint I cannot back up with those things we call facts, I must admit that I do enjoy making you, El Dingo, and zridling look like the complete morons you are.

...a direct contradiction of your complete inability to back up any claims you make (Crysis and The Witcher work in Linux??), and your penchant to descend directly to personal insults and infantile jackassery when *anyone* disagrees with you in the slightest.

Score: 0

|

So... I can't be a fanboy then, because I say: LINUX IS NOT PERFECT. NOTHING IS PERFECT.

Score: 0

|

Never said you were. You may be a little delusional at times, but I wouldn't call you a fanboy.

Nope.

If you were my cat, I'd call you Fred. ...or Wilma. Ya know...depending...

Score: 0

|

It seems to me that all the time used to whine, complain, argue, insult, pout, and be sarcastic could be used to find and implement a solution.

Score: 0

|

You bore me.

Score: 0

|

Glad I clicked restart later just now, blah

Score: 0

|

I find it a little irresponsible to report this as though it has not alreay been fixed. The javascript garbage collection problem came out in 2.0.0.13 and the update today 2.0.0.14 fixes it.

If you are going to report that there was an error at least report that it has been fixed.

Score: 0

|

Think again if you don't believe corp america doesn't use firefox. Our company uses firefox exclusively and IE is not to be used, period!

Score: 0

|

The Linux version seems to be ok on my system.

Score: 0

|

Should we be suspicious of .13 releases?

Score: 0

|

Well I am using ,in the case of FF, version 2.0.0.9. So I don't know about later higher decimal versions put out except the latest.

Score: 0

|

Only if you live in China.

(Sorry. That was a reference to a Season 1 NCIS episode.)

Score: 0

|

Well, you must not be using FF with an Internet connection. Since FF automatically downloads security updates. LOL

Score: 0

|

Automatic can be disabled as I do for most software and I am not using a traditional internet connection plus I have not made FF my default browser.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9"

Have a nice day:) But since I don't have an "internet connection" i am using magic. Poof:)

Oh and I am using it now.

Score: 0

|

And will someone with heavy tech experience explain to GS5 that automatic d/ls can be disabled. I hate having to use magic to connect:)

Score: 0

|

It's official, tscar13 is the BetaNews Forum "VILLAGE IDIOT".

Score: 0

|

Gee.. that hurts. Surely you can come up with something better.

At least you know where the cap lock is on the keyboard. Maybe there is hope for you.:)

Just curious but what does this official title pay?:)

Score: 0

|

to Answer your question. Most programs during set-up give you a choice between express d/l in which they d/l everything or custom. If you choose custom then usually you can uncheck the automatic d/l option.

Score: 0

|

Firefox is a joke anyway & not utilized in Corporate America so I guess all you home-users that think you're tech savy are possibly in for a continued vulnerability ride!

Score: 0

|

Look at your name and what are you saying? Hard to take you seriously. Many State and County offices are running on Linux now and running Firefox. Keep using your "Windows" and "IE". You are truly Mr. Tech Savvy.

Score: 0

|

I prefer not to use it but FF is *extremely* popular in the IT departments (you know... the guys who actually deal with and build the information systems...) of Corp U.S.

Score: 0

|

ok I admit i sometimes have trouble following the responses and to whom they are directed. Boise? who were your comments directed at?

Score: 0

|

I'm the lead web developer for a $400 million dollar a year company and our corporate policy is to use FireFox. FF was chosen because it is WC3 standard compliant and consequently we can develop our internal intranet using cutting edge JavaScript as well as CSS. It is also by nature more secure. Many corporate IT departments are moving their users to FF for this reason.

Score: 0

|

Those would have been directed to luvwknd69. :)

Score: 0

|

Everybodies comments are directed at you and only you. You know that, don't you.

Score: 0

|

Yes,
That is correct. It was directed toward "luvwknd69".

Score: 0

|

Wow.

I think that has to be one of the dumbest things I've heard this week...and you're following tscar13's lovely little romp outside of sanity.

Firefox is the hardline standard at at least 4 of the businesses I consult for and the defacto standard for another 2.

all you home-users that think you're tech savy are possibly in for a continued vulnerability ride!

Name me one piece of software that isn't "vulnerable", ignoramus.

Score: 0

|

That was dumb.

Score: 0

|

Ahh..I can feel the love in the air:)

Score: 0

|

Thanks Pc:) but I deserved that but in my romp maybe one or two here have wised up and know that all software is vulnerable:) so maybe it wasn't in vain.

I take that back..some minds and I use that term loosely will never change.

Score: 0

|

I really *really* doubt anyone here *ever* thought any software they used was invulnerable.

There is no such thing.

We all know that. Do we simply not discuss it enough for you? (It *is* possible to like, for example, Firefox and Vista, above all others while realizing that neither of them are anywhere *near* perfection)

Score: 0

|

Everyone have a good evening.:)

Score: 0

|

You may be right bit it is hard to tell from many comments but I do think some here actually do think what they type and I guess I expected more from a "tech" site. That was my mistake among many and probably not my last:)

I will say it is not very encouraging to see the types of comments from GS5. HE/SHe/IT doesn't even seem to grasp that most programs
give you a choice on whether to install all their junk or cherry-pick what is installed and that the usual default is set to install.

It is ironic, in a way, that MS doesn't do it that way but they leave it up to you to checkmark what to install even when set to automatic install. In automatic update it is a 2 step process: step one automatically d/l but step 2 requires you to make a choice (At least Apple and MS). But, for what it's worth, I would advise everyone to always choose "custom" or whatever name the program gives it and you will be amazed at the junk some of these programs try to install on your system.

And GS5? I mainly use WiFi since I refuse to pay the outlandish prices cable, dsl or those network card companies charge. Oh and I am still using FF and the same version.:) no updates.

Score: 0

|

Just because M$ is a big corporate thing doesn't mean FF is bad.

Score: 0

|

Best comment in article.

Score: 0

|

That ain't love. I'd duck if I were you. :p

Score: 0

|

First this just shows that no matter how well-intention the idea (open source), there will still be problems. Beta 3 of FF has its problems and that is why I've gone back to an earlier version.

On a side note, here's something for everyone to talk about or shoot me,maybe these betas being made public, in the end, are not a good idea because it gives those with less than honorable morals time to find the weak points.

At the end of the day, no Browser or OS is going to be able to give you complete security. That's why it is important that people constantly think outside the box in revamping the computer systems.

Score: 0

|

Isn't this story a tad late? 2.0.0.14 was just released fixing that bug.

Score: 0

|

Crying wolf after it's been shot dead? Amazing timing, Betanews.

Score: 0

|

Except that it didn't fix it... I just crashed 2.0.14 by trying to post this reply.

Score: 0

|

Good for you, and we're all really excited for you and all, but are you sure it was due to this specific issue?

Score: 0

|

Well that proves it I guess. Could not have possibly been caused by anything else.

I never had any problems with 2.0.13 and so far 2.0.14 is fine too.

Score: 0

|

Screw Firefox and the "I'm not going to use anything MS", no wait, "M$" crowd, except the fact that it's running under Windows. I tried it a while ago, it worked OK.

As soon as MS stole all thier good ideas and put them in IE7, I stopped using FF. It's a browser for crying out oud.

Safari sucks a fat ass, the tables on certain pages load completely wrong and the fonts are rounded and goofy looking.

Score: 0

|

Way to post On Topic there, Hollywood.

Score: 0

|

Oh, I get it. You are missing the good old HD vs. Blu days, right..?

Score: 0

|

Apparently.

As soon as MS stole all thier good ideas and put them in IE7, I stopped using FF.

I must have missed the whole bit where IE7 got all those useful add-ons for adblocking, tab management, download acceleration, and webpage customization.

Score: 0

|

Duh??? PC_TOOL

All those features added into IE 7 and then some.

http://www.ie7pro.com/

Yeah Baby!!!! (Sorry had an "Austin Powers" moment there)

Score: 0

|

And this post is on topic?

Score: 0

|

I didn't know MS released a pro version of IE oh wait they didnt.....

Score: 0

|

no but this one is. :)

Score: 0

|

> Screw Firefox and the "I'm not going to use
> anything MS", no wait, "M$" crowd, except
> the fact that it's running under Windows. I
> tried it a while ago, it worked OK.

I dont use firefox because I hate microsoft. I have no personal allegiance to any company. I use what works for me.

But, as a web developer I use it because 24% of web surfers use it, and I need to design sites that work for IE, Firefox and Safari.

> Safari sucks a fat ***, the tables on
> certain pages load completely wrong and the
> fonts are rounded and goofy looking.

This is not an issue with Safari. This is an issue with the fact that web site designers ignore a large portion of their user base. It is not that hard to design sites that work across platforms, and with the rising number of mac users that use Safari, and probably some PC Users now that Safari has crossed that gulf, it is becoming more important to do this.

As a side note; you really show your maturity with the way you swear in your posts.. Are you 12?

Score: 0

|

What about this one?

Score: 0

|

Since I use both, what I find interesting is that, depending on your security set-up or security software used, FF loads slower than IE7 but seems to move quicker from site to site. Interesting and I am not sure why. But FF does need to start requiring all developers to signed their addons. I am uncomfortable d/ling any addon that says "unsigned".

As far as IE7pro, I didn't see any advantage to it and uninstalled it.

Score: 0

|

"I dont use firefox because I hate microsoft"

ok..am I missing something? What does FF have to do with MS. Maybe MS has undercover agents working at FF to undermine it.

As far as Safari, there is still a constant problem that is not the fault of web people and that is safari sometimes can't form a ssl link to ecommerce sites and the responsibility for fixing lies with Apple not the Web developers.

added note:"I have no personal allegiance to any company. I use what works for me." what you go on to say seems to contradict this statement and your previous statement.

further note to Hollywood- correct me if I am wrong but doesn't

ff work on any OS? So if you hate MS so much than why use it.

Score: 0

|

In spite of your "Duh?" bit I may actually have to check that out.

On my Vista system IE loads and renders a hell of a lot faster than FF, and it looks like this "remake" might actually make it *useful*.

Score: 0

|

You're off-topic, he's off-topic...

We're *all* off-topic!!!

We don't *need* no stinkin' topic (as we tend to completely ignore them anyway)

Score: 0

|

That's not a Microsoft product, it's a third party addon.

Score: 0

|

maybe it's time to upgrade since I still use XP though I think the problem with the loading on my system is security software related because when I turn off the security, IE7 does load faster.

Score: 0

|

I keep having an annoying problem with IE7Pro mistakenly hijacking IE7 at initiation to notifying me that my last IE7 session terminated abnormally. I have tried disabling that feature to no avail. I probably should do some digging at the IEPro site to see about correcting it, but I primarily still use FireFox because I like the FF addons for popups, ad banners and such better than IE7Pro anyhow.
Just a head's up.

edit: Oh, and I like the FF feature of being able to drag tabs around like shortcuts to drop them onto the link bar, desktop, or Live Messenger... IE7 doesn't seem to support that.
Yet. =)

Score: 0

|

I mostly use FF, but sometimes I use IE7 with IE7pro and its ok, but its tab management isn't that great.

I just think FF needs to take its hottest add-ons (tab mix plus, all-in-one sidebar, and noscript, to name a few) and just add some of those properties into FF. This would optimize it better, making it load faster and probably also use less resources.

Score: 0

|

I take it you hate the internet, PC's, Just about everything tech. wise. So why r u posting something as dumb as this.

Score: 0

|

I have IE7Pro installed, and it pretty much adds the best features from Firefox. But try out the Firefox 3 betas first. Beta 5 runs lightning fast on my Vista laptop compared to IE7Pro.

Score: 0

|

Don't "upgrade" to Vista from XP. Do a clean install *only*, and *only* if your system has the hardware for it. Otherwise, stick with XP.

Score: 0

|

Doesn't add much at all from what I can see. Its "ad blocker" doesn't even support premade lists like Adblock Plus. Oh, and nice save on the headline, BN :)

Score: 0

|

Thanks PC. From what I've read hear that would be the best approach. While re-formatting the hard drive is a drag, the complaints about just upgrading clearly indicate a problem and the only solution will be a re-format.
hardware is a good question. Too often PCs say they are Vista ready but don't have the power to handle it.Thanks again for the input.

Score: 0

|

I'm not sure if that more about us or BN reporting of what they see the news is.
"BetaNews reserves the right to remove any comment at any time for any reason." gotta love a site that says something like that. All Hail almighty Betanews:)

Score: 0

|

All sane websites have something similar if they allow *any* user created content.

...as you yourself have shown, it is a necessary Evil.

Score: 0

|

>FF loads slower than IE7

Without having tested at all I believe that FF
checking for updates causes that delay.

Score: 0

|

>"BetaNews reserves the right to remove any
>comment at any time for any reason."

That's called not being stupid in these liti-
gious times.
If BN had to give a reason for each removal
there would be a lot more people pushing the
limits.
These More People would be tryin to get re-
moved ( =libeled) so's they could sue about
how their little dog spot won't lick 'em in
the eye since BN so randomly and evily said
they was....

Heh, I better take a nap 'cause I spelled
"look" wrong ;P

Score: 0

|

Finally, a useful post. The spell check is one of Firefox's better features, so I'll try anything once.

Score: 0

|

Haven't tried FF 3 beta 5 but I did have to uninstall FF 3 beta 3 for Firefox 2 because my add-ons weren't compatible with FF 3 beta 3. But that's not FF's fault.

Score: 0

|

If, during installation, you allow it. I think it is the security software because when I turn it off, FF works fine.

Score: 0

|

not as sweeping. Usually it only pertains to attacks on individuals and even here BN didn;t act. MY case is a good point. But look at yours and everyone else's attacks. They are still here.
If you're going to have a sweeping clause like that then enforce it otherwise leave it out. Say only what you can enforce. And then do it but not at the expense of other's posting. Sure I crossed a line..well.. ok crossed by a country mile ( someone used that expression and I like it though I wonder if there is a difference between a county and city mile), but BN did nothing. So there is no point in having a TOS if it isn't enforced even-handedly and across the board and that includes me:)
Finally, the lawsuits tend to happen WHEN a site does NOT enforce it's TOS not the other way.
I should have been deleted and my SN deleted for some of the things said and so should some others but it doesn't happen. So there is no point to BN having a TOS.:)

Score: 0

|

Here's how it works from what I have seen:

It takes either a threat against the site (you), a report from a user, or mods discretion (usually s site or "journalist" insult).

A string of these from the same user will tend to have that users posts looked at more closely, resulting in one poster seeming to be "picked on" by the mods.

Regardless, it's their site. They can run it any way they wish. Freedom of Speech does not apply. :)

Score: 0

|

Have to agree. The internet creates ambiguity in the issue of Freedom of speech that hasn't been sorted out yet. In Public, there are limits to our rights but everyone is still scratching their heads or some other body part on how to apply this to the internet and forums in general.

Whatever policy a site has and it's up to them , to a certain extent, i do think they should be held accountable for applying those standards in an even-handed manner. Frankly, I was expecting them to delete my over the top posts and maybe even my Sn but, alas, they didn't.

Sp I do think if you have a TOS then you need to enforce it.

Score: 0

|

The internet creates ambiguity in the issue of Freedom of speech that hasn't been sorted out yet.

Are you high? No, seriously.

Freedom of Speech is protected *only* in regards to the government. It is *not* a protected right in regards to *anything* else. Period. Why is it everyone seems to think "Freedom of Speech" gives them the right to yell "Fire!" in a theater (Or, in your case, "Hack!" on a website)??!?

It doesn't....unless *you* own the website and the service it is hosted on.

...this is pretty basic stuff, tscar13.

Sp I do think if you have a TOS then you need to enforce it.

They do. They often enforce their right. The ToS never said anything about being even-handed or fair about their reserved rights. :)

Score: 0

|

Hello PC:) First part of your response regarding"fire" is correct. If you yell "Fire" you can be charged.. In a public gathering , we have established or reconciled the bill of rights with the Rights of society (for the most part). On the internet and in these type of forums that hasn't been settled. The 2nd is not. There has not been a single case brought to court in the U.S. regarding limits on freedom of speech on the internet or what is the responsibility of owners of forums in putting in place a TOS and then enforcing it. and there needs to be one.

If a site has a TOS and does not enforce it even-handedly or not at all they can be subject to a lawsuit which will happen at some point, maybe not involving BN but some forum and it will be interesting to see how the courts settles and sort this question out.

I happen to think that the courts will side on the side of the individual and not the owners or operators of these sites on this issue.

On other non-tech sites, there is a growing clamor about this very issue that BM ignores as well as other sites because they think that just because they put a notice up that it absolves them. What they don't seem to get is that there is a 2nd part to having a TOS and that's enforcement.

If they were to do their job and enforce then that brings in the issue of being fair and even-handed just like enforcing laws in society. Fine if they want to delete my SN as long as they treat others the same. If they don't or any other forum doesn't then the lawsuits will fly and the owners will ultimately lose even with the strict constructionist sitting on the Supreme court.

Talk to any well-established lawyer and you will hear that I am right. Even take in a copy. Or go to the Law school where you live and ask a prof. this question.

I think, at the end of the day, you don't want enforcement because you do enjoy bickering with people.

But in any article and set aside my over the top which clearly demonstrates the owners don't know much, and you will see countless violations of their TOS. Freedom of speech on the internet is like that in our society- there must be limits placed and if the owners of these sites want to make money then they need to develope a concrete TOS and enforce it. Even if TSCAR13 and PC_Tool cease to exist.

I'll make this deal with you. You find the best-rated civil attorney in your area and take in a copy of what I have said and if he/she disagrees, I will pay for their time. I'll leave it up to you to figure out how to make this deal work without compromising your true identity or mine and I will then communicate with him/her to verify. That's fair and then we will jointly post his/her opinion on here.

If you truly believe what you wrote then this should be no problem for you.

I respect you PC even though we sometimes disagree. I recognize your tech knowledge so, despite my over the top rantings, take me up on the offer and there is no limit on cost per hour.

Have a great Weekend:) and try not to slam me down too hard cause I have a bad back:)

Of course, if you don't want to take me up on my offer, then I will take in all the postings all articles going back sometime to my attorneys (ice Miller) and get their opinion and see what they have to say.

Oh and if they say, in legal terms, I'm full of Sh** I will post whatever they say:) I wonder if that is a violation of BM TOS?

Score: 0

|

PDC 2009: What have we learned this week?

There was the freebie that no one will forget, the heebie-jeebies courtesy of Scott Guthrie, and a teensy bit clearer picture of how this cloud thingie should work.

Live report: Will Google Chrome OS change Linux?

The mysteries of just what Chrome OS is, and how much of an operating system it truly is, may be resolved today.

PDC 2009: Microsoft cares about Web browser performance

The effort to give users of the world's dominant Web browser the impression of quality, is a personal one for the man who leads that battle.

Nokia re-affirms its commitment to Symbian, sort of

Maemo won't necessarily be replacing Symbian in the Nokia N-Series, but that's definitely a place where it will be found.

E-book readers will be in short supply this holiday season

E-readers are hot this year, and a lot of compelling new products have been released, but are there enough electrophoretic displays to go around?

Sony looks to finally open a single storefront for downloads

Sony has had many different download portals for movies, music, e-books, and games, and now it's looking to make a single shop for all of it.

Tuning out the tablet: Time to give the endless speculation a rest

Wide Angle Zoom: Wishing and hoping and thinking and praying....won't put an iTablet on the market.

Five improvements for IT managers in 2010

If businesses are to improve their efficiency for next year, they need to stop and reassess the basic tenets of their job.

AOL's spinoff from Time Warner to shed 2,500 jobs

As AOL moves toward become an independent company again, it will cut nearly a third of its workforce.

Gartner: SMS-based money transfer will be bigger than mobile browsing, search

Gartner issues its predictions for the 10 things our phones will be doing in 2012.

Don't forget to upgrade to Firefox 3.6 beta 3 today

Mozilla has released the latest beta its Firefox 3.6 browser software, just over one week after beta 2.