Major security bug fixed in Firefox

Mozilla is advising fans of Firefox to update the stable version of the browser after it released a patch for a security bug marked "critical" today.

Available for Windows, Mac, and Linux, Firefox 3.6.12 patches a heap buffer overflow that could allow for remote code execution. Mozilla notes that the bug affects the current version 3.6 branch of Firefox, the legacy version 3.5 branch, and could potentially affect Thunderbird users who load Web pages in the RSS reader.

The bug has not been found in the upcoming version 4, currently in beta development and behind schedule. Firefox 4 beta 7 was originally due in the middle of September, then pushed back to the end of September because of a stability bug. Mozilla has since initiated a code freeze on the next generation of its browser but has yet to update the schedule because of multiple critical bugs. It's expected that Mozilla's updated JavaScript engine will land in the seventh beta. Called JaegerMonkey, it's currently available for testing in the Firefox nightlies.

Source: CNET

Firefox Fixes Security Holes, Update Your Browsers

Mozilla launched two new versions of its browser on Tuesday, Firefox 3.6.9 and Firefox 3.5.12, to shut 10 critical security vulnerabilities in every and to assist Site operators block a threat known as clickjacking. Firefox 3.6.9 can be accessible from CNET Download.com for Windows, Mac, and Linux

Crucial vulnerabilities can let a remote attacker run arbitrary code on a computer. With Net browsers turning into each extra essential and more powerful, browser makers should always watch for new assault possibilities.

Firefox 3.6 additionally will get a new common strategy to cut down searching risks: assist for what's called the X-Body-Options HTTP response header. Website online developers can use this know-how to block browsers from exhibiting their Websites inside a body--basically a smaller window within the browser window. Placing a professional website inside a body on a malicious website is one approach for attacks referred to as clickjacking, during which the malicious website can capture keystrokes resembling usernames and passwords.

For the new variations of Firefox 3.5 and 3.6, 9 of the 10 important vulnerabilities are the same, but one drawback on 3.5 is minor on 3.6, and one 3.6 problem did not affect 3.5. In addition, a number of noncritical security vulnerabilities have been patched. Full particulars can be found on the security pages for 3.6.9 and 3.5.12.

Mozilla also is racing to release Firefox four this year. It released a fifth Firefox four beta on Tuesday, including assist for some hardware acceleration on Home windows, amongst other features.

Nevertheless, not all the Firefox 4 hopes are coming to fruition. In line with meeting notes published Tuesday, one other function slipped off the roadmap: a Firefox developer device referred to as the Inspector that might have made it simpler to find particulars about parts on Web pages.

It additionally appears doubtless Mozilla won't meet its Friday deadline for freezing the code base for the sixth beta--the final cutoff point for getting new features into Firefox 4. A week later, September 17, now appears more probably, in line with the assembly notes.

Also up to date Tuesday had been the secure and beta versions of Google's new Chrome 6 browser with the discharge of model 6.0.472.fifty five (Home windows | Mac | Linux). This update fixes problems with autofill, which may enter data akin to addresses and names into Internet kinds; the overwriting of the default search engine setting; and some points with Chrome's translation ability.


Learn more: http://news.cnet.com/8301-1009_3-20015650-83.html?tag=nl.e757ixzz0zBFDv9y6