Critical Flaws Patched in Firefox

By Ed Oswald | Published July 27, 2006, 5:38 PM

Mozilla said Thursday that it had released Firefox 1.5.0.5, which includes several security fixes and stability improvements over previous versions. It is also expected to be the last version of Firefox before developers turn their attention to Firefox 2.0, due out September 26 according to the latest roadmap.

"Firefox 1.5.0.5 is a security update that is part of our ongoing program to provide a safe Internet experience for our customers," Mozilla said in its release notes for the new version. "We recommend that all users upgrade to this latest version." Users of Firefox 1.0 are also strongly urged to upgrade due to the security enhancements provided.

Among the critical flaws addressed in the new release are a memory corruption vulnerability that occurred after a crash of the browser, four JavaScript issues including one that poses a privilege escalation risk, another memory corruption issue caused by simultaneous XPCOM events, and a code execution risk through a deleted frame reference.

All told, the latest version of the browser fixes some 12 issues; seven rated "critical, 2 "high," and three "moderate" by Mozilla. The company considers a flaw critical if it can be used to run code and/or install software, and requires no user interaction beyond normal browsing.

Mozilla also released Thursday an alpha version of Thunderbird 2.0, the company's e-mail client. According to a list of tentative enhancements, new features will include tabbed messaging, favorite folders, a conversations feature similar to Gmail, and improvements in the handling of junk mail among other features.

Comments

View comments by with a score of at least

Critical!!! Awesome!!! The Final Countdown!!!!
Fear pays

Score: 0

|

Score: 0

|

Tired of "criticals". They got near to MS stopping support for old OS users. Why? It is a bad path: If they stop supporting us, we shall stop supporting them. We old users are not toys in the hands of anybody, and nobody has the right to stop support and hope to keep being supported.

Score: 0

|

How exactly are you "supporting" MS?

Score: 0

|

another browser war discussion. great.

Score: 0

|

Ah yes it is great isn't it? Nothing like seeing a bunch of fan boys making fools of themselves. With us sane people trying to beat some sense into them.

Score: 0

|

Is it just me, or is this getting incredibly old for anyone else?

Score: 0

|

Try and be a tad more specific. Are you referring to:
1. The Story itself, if so, what tenet of the story?
2. The comments below you? If so, please elaborate.
3. betanews comment posting, in which case, shouldn't you review your psyche for cohesion?

Score: 0

|

Take your pick. I'm an equal opportunity b****er.

Score: 0

|

I go for #2, and I'm with you 100%.

Elaboration: *see my replies to comments below*

Score: 0

|

I'll take #2 as well. All this fan boy crap is enough to make anyone gag. I can't wait until Vista come out I can just see it now..... ya got a Firefox and IE fan boy arguing over whose browser is best. Then someone on Vista comes into it say my IE is better than you IE. The XP IE says nu uh I'm telling my mommy.. you tell lies.

Score: 0

|

Is anyone here old enough to remember "Pee Wee's Playhouse" on Saturday mornings ? Do you remember one of the regular characters, "The King of Cartoons" who would play a cartoon on an old 35mm reel projector ?

Every time I see this topic reappear I think of him and the grand way he would announce the cartoon as he switched on that old clunky projector...

"LET THE BROWSER WARS...BEEEGINNNN !"

Score: 0

|

Only thing getting old is your useless rants trying to defend Microspud

Score: 0

|

Yes, beause we all know how PC_Tool blindly follows MS, never doubting anything they do ever. He could, almost, be called a disciple of MS, almost.

To be serious though, nothing gives away a fanboy faster than using terms like Microspud.

Score: 0

|

Haha, you all are funny!! Fighting over which browser is better. Who cares ... really!? Use what is comforable for you, and just a note, as long as software is developed by humans ... it's going to have holes in it, no matter if it's Mozill Foundation or Microsoft code, its a fact of life. That was my 2 cents worth ... flame away ... if you must!!

Score: 0

|

I have to agree with you, use whatever is comfortable for you and your needs. Now that being said, I practically use three browsers every day: Firefox, Opera, and Internet Explorer. They all have their strengths and weaknesses - though I rarely use Internet Explorer, only to make sure websites still can be viewed in a somewhat 'proper' way or the rare website that "Must be viewed with the latest version of IE." Opera and Firefox are the main ones I use, Firefox releases updates - all software companies do this, accept it as something that happens. The world changes everyday, and you have to update to keep up. Enjoy whatever you use to browse the web.

Score: 0

|

F for Firefox ; F for First....
I for InternetExplorer ; I for Idiotic

There.....as simple as that.....

Firefox > All other browsers on earth

Score: 0

|

Wow, your logic is genious, how long did it take you to sit and conceive such an ingenious theory?

I am glad to see, however, that you can find words that begin with the first letter of each browser. Guess that kindergarden education is paying off.

Please, post when you have some real content to add to this discussion. All this article is proving is that mozilla is patching firefox because, GASP, there are holes in it. We dont hear about them because no one bothers to report holes in a product that doesnt hold a majority market share like they would for one which did. Trust me, let firefox get 90% market share and we shall see how many of these exploits are pointed out.

Score: 0

|

Here he is, boys. I found the fanboy you were looking for...

I'm sorry, but it's really pathetic to care so much about what browser *other* people use. Use what works for you and keep your mouth shut.

P.S. I use Firefox as my primary browser. So save your keystrokes.

Score: 0

|

Oh who cares, IE 7...Firefox...whatever. I'm just going to use Firefox because it's easier to use because i'm so used to it, and I know Mozilla while not perfect will always be actively developing patches for security flaws anyways. Which is more secure? at some point in time, one will be more secure than the other depending on who releases patches faster. I'll put my money on Firefox when that happens.

Score: 0

|

agreed. i care less which browser is better, i visit the same site day in and day out, not like i am going to some porn sites or warez. I choose ff for ez to use too.

Score: 0

|

Well put. One of the better posts I've seen on fileforum. Use whichever browser suits your needs, dont use it because its the "cool thing" to use at this moment.

Score: 0

|

Indeed, that is all that really matters - which browser you are most comfortable with. I've tried several: Firefox, Opera, Maxthon, Avant and IE7. They all offer something appealing to me, so I haven't yet settled on anything, though Firefox and Opera are looking good. IE performs well and I use it for MS updates and the other odd occasions, but I avoid it otherwise because of all the idiots attacking it.

Score: 0

|

"The company considers a flaw critical if it can be used to run code and/or install software, and requires no user interaction beyond normal browsing."

There you go. Fanboys: quit claiming Firefox has no flaws that allow viruses on the PC without user intervention--Mozilla says the opposite.

Normal users: no need to flame--I am only speaking to the ones that say Firefox has nothing that "critically" affects it is all. Enjoy the much more secure Firefox, and watch out for rotten extentions :)

Score: 0

|

I run FF as a restricted user, am I affected?

Score: 0

|

I'm glad somebody said it. I use Firefox as my primary browser myself. Anyone who claims that it's flawless, 100% safe, etc. is only kidding themselves. A lot of people just use it as the proverbial hammer to bash Microsoft Internet Explorer with.

Score: 0

|

...most likely not.

But if everyone was running *any* browser as a restricted user, they really wouldn't have to worry about 90% of exploits.

Score: 0

|

Less critical:
http://secunia.com/product/4227/

Highly critical:
http://secunia.com/product/11/
(I.e. pretty much ALWAYS has a highly critical vuln, at least for the past three years)

The numbers don't lie:
105 Advisories: IE
34 Advisories: Firefox

Score: 0

|

Counting IE 5.5 problems in there too I see?

You're comparing apples to oranges--the numbers may not lie, but the conclusion can. Those numbers in and of themselves will mean nothing when we compare IE7 to FireFox 2.0. The whole game will change.

Score: 0

|

"The whole game will change."

Cross your fingers, and hope for the best here.

;-)

Score: 0

|

Yeah I'll wait for IE 7. How convenient we had to wait several years for somehting secure from MS.

Also nice to have a product that was kind've half-assed. They weren't going to even bother with IE7 until last year, when FF market use started taking share away.

Score: 0

|

The numbers don't lie:
1050000 People Attacking: IE
2 People Attacking: Firefox

Score: 0

|

Well said. It is actually one of the reasons I use FF, because I know fewer people are attacking it than they are IE.

Score: 0

|

Fine. Strengthens my argument. Attack firefox all you want, with noscript extension on every single page except those I've whitelisted, you won't get far.

Score: 0

|

They weren't going to even bother with IE7 until last year, when FF market use started taking share away.

Why spend R & D on making something better when the current product already dominates the market? I'm not saying I like IE6, but from Microsoft's business perspective it really wouldn't make sense until something changed.

Firefox (and, some might argue, Opera) brought about that change. Kudos to them for doing it, too.

Score: 0

|

"Firefox 1.5.0.5 is a security update that is part of our ongoing program to provide a safe Internet experience for our customers,"

Customers pay money, users don't.
Oh right, the sneaky google advertising...

Score: 0

|

"Customers" is always used in relative terms. A customer is a consumer of a product. It doesn't necessarily mean the consumer paid for the product.

And for the sake of argument, I have Google Ads blocked With AdBlock+. :)

Score: 0

|

For all the IE bashers out there (please click Post a Reply and proceed to talk crap about MS)

I thought Firefox was flawless?

Score: 0

|

Where's the virus (in the wild) that exploits it?

'nuff said

Score: 0

|

Could you be any more obvious? You fan boys make me sick, IE, Opera, and Firefox alike. You all treat a freaking browser as if it's some kind of religion. I think everyone that didn't have the common sense to know it before figured out that Firefox isn't perfect after the 1.0.1 release. So don't ya think it's about time to drop it?

Score: 0

|

Amen, brother! ;)

Score: 0

|

Where's the virus that exploits half of the IE holes? Most of those are just proof of concept code with no "In the wild" virus or exploit.

now to quote you

'nuff said

Score: 0

|

I guess we imagined malware like the subject line iframe exploit between internet explorer and outlook a while back. Then there was the embed vulnerability.

Hmm, I guess you said MOST.

Too bad "MOST" of those vulnerabilities had active malware.

google it.

HINT (first hit): http://www.us-cert.gov/current/#2ievuls

'nuff said

Score: 0

|

"Where's the virus that exploits half of the IE holes?"

OOOHHH NO, you asked for it now bud :)

Even as a loyal Internet Explorer user, I can name dozens of viruses that exploit vulnerabilities in IE.

Score: 0

|

didnt say there werent some being exploited, I am saying do all of these "holes" have exploit code that is exploiting pcs?

I wouldnt hold half of the holes against FF since again, most of them arent being exploited.

Score: 0

|

to be frank...
IE sucks...you don't know how many countless hours i spending researching and looking up hacks for my standards xhtml strict/css website to render properly in IE...

the IE rendering engine is a decade old hack... it takes freakin hacked shortcuts to speed up rendering in certain situations and thats why page which take advantage of xhtml and css 1/2 do NOT render properly. A simple thing as the box model for html is BROKEN and implemented wrong in IE...

IE screwed me over many hours of lost productivity ... the world needs to stop using IE PERIOD... think about your web developers...

please us OPERA/FIREFOX/ANY STANDARDS COMPLIANT BROWSER... think about your hard working developers not getting as much sleep as they should be getting because you browser with IE...

Score: 0

|

i'll use lynx thanks.

Score: 0

|

heh

Score: 0

|

Yes...the "Highly Critical" flaws in IE Secunia pointed out 1.5 years ago aren't so critical as no one is exploiting them, I agree on that. Why do they still have them listed, you ask? Same reason every business sticks with the same approach for so long, then never admits their mistake--they act like they are adapting to future needs:

No business will ever admit they were wrong. Ever. There are exceptions to this rule, but they are few and far between.

Score: 0

|

How can you use linux if you can't even spell it??

Score: 0

|

Score: 0

|

Fanboys are annoying.

'nuff said.

Score: 0

|

Breakthrough: AMD and Intel settle antitrust dispute, reach new cross-license agreement

UPDATED Only exclusionary business practices, not some rebates, may be covered by a new agreement on Intel's future business conduct.

Windows Marketplace for Mobile now available in browser, iTunes' App Store still not

You can now check out what Windows Marketplace for Mobile has to offer without a Windows Phone.

Microsoft damage control after marketer claims Win7 inspired by Mac

Have you ever said anything you wish you could take back? Ever? No? Not even once? Well then, you won't sympathize with a mid-level Microsoft manager today.

Facebook for iPhone developer goes from Apple supporter to 'I quit!' in 3 months

Fed up with Apple's App Store policies, the developer of Facebook for iPhone has bailed on the iPhone.

Google acquires Gizmo5, builds IP telephony portfolio

Google Voice today confirmed rumors that it would acquire IP telephony company Gizmo5

'A pivot from war to peace:' The AMD + Intel armistice, in their own words

An extraordinary day in technology history is recognized by two long-time rivals that mutually decided it's futile to fight anyplace else except the marketplace.

PS3, Xbox to soon get Twitter, Facebook integration

Both Microsoft's Xbox 360 and Sony's PlayStation 3 will integrate with Facebook in the near future.

The iTunes App Store at 100,000: Can we stop counting, already?

Carmi Levy | Wide Angle Zoom: Is a six-digit number truly reflective of a healthy applications ecosystem? Or is it another type of bloat?

Analysis: The end of business-by-litigation?

The AMD v. Intel case ended neither with a bang nor a whimper, but almost with a song. Is it catchy enough for the rest of the PC world to sing in perfect harmony?

The agreement: Intel and AMD 'wipe the slate clean'

As the Securities and Exchange Commission document shows, AMD did indeed make some compromises in favor of Intel, especially with regard to conduct.

EC still holds Intel accountable even after AMD settlement

Though the future of relations between AMD and Intel may be peaceful now, the EC believes Intel may still owe restitution for its past conduct.