Firefox ships patch for 12 security flaws.

[honey5]

Mozilla has released another point update for its flagship Firefox browser to provide fixes for at least 12 documented security vulnerabilities. Some of the flaws put millions of Web surfers at risk of remote code execution attacks.

 

The Firefox 3.0.2 update addresses two issues rated by Mozilla to be “critical,” meaning that the documented vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing.

 

• 
  
• MFSA-2008-40 - Mozilla developer Paul Nickerson reported a variant of a click-hijacking vulnerability discovered in Internet Explorer by Liu Die Yu. The vulnerability allowed an attacker to move the content window while the mouse was being clicked, causing an item to be dragged rather than clicked-on. This issue could potentially be used to force a user to download a file or perform other drag-and-drop actions.
  

• 
  
• MFSA-2008-41 - Mozilla security researcher moz_bug_r_a4 reported a series of vulnerabilities by which page content can pollute XPCNativeWrappers and have arbitrary code run with chrome privileges. One variant reported by moz_bug_r_a4 only affected Firefox 2. Mozilla developer Olli Pettay reported that XSLT can create documents which do not have script handling objects. moz_bug_r_a4 also reported that document.loadBindingDocument() returns a document that does not have a script handling object. These issues could also be used by an attacker to run arbitrary script with chrome privileges.
  

• 
  
• MFSA-2008-42 - Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Drew Yao of Apple Product Security reported two crashes in Mozilla image rendering code. This vulnerability only affected Firefox 3. David Maciejak also reported a crash in graphics rendering which only affected Firefox 3.
  

• 
  
• MFSA-2008-43 - Microsoft developer Dave Reed reported that certain BOM characters are stripped from JavaScript code before it is executed. This can lead to code, which would otherwise be treated as part of a quoted string, to be executed. The issue could potentially be used by an attacker to bypass or evade script filters and perform an XSS attack. Security researcher Gareth Heyes reported an issue with the HTML parser in which the parser ignored certain low surrogate characters if they were HTML-escaped. This issue could potentially be used to bypass naive script filtering and used in an XSS attack. This issue only affected Firefox 2.
  

• 
  
• MFSA-2008-44 - Mozilla developer Boris Zbarsky reported that the resource: protocol allowed directory traversal on Linux when using URL-encoded slashes. Mozilla developer Georgi Guninski reported that the restrictions imposed on local HTML files could be bypassed using the resource: protocol. The vulnerability allowed an attacker to read information about the system and prompt the victim to save the information in a file.
  

The open-source group also released patches for multiple vulnerabilities affecting Firefox 2 but strongly recommends that users upgrade to Firefox 3.

[robin9342]

I still feel much safer using Firefox than I.E. Mine auto updated to 3.0.2 in any case.

[installspark]

The latest version on the mozilla site is 3.03.

 

Prefer Firefox to IE7 for many reasons, especially the security of te browser and the updates available almost as soon as a vulnerability is discovered. The joys of open source.

[WebFerret]

It's all down to preference really - I use IE7.

 

No software is 100% secure in my opinion - if you’re physically connected to the net then there is opportunity for your

system to be compromised - the reason I choose to run two PCs and choose not to do online banking - one simply for

internet access - the other (standalone) for my main activity and store of personal information.

 

As long as you've installed a good firewall & antivirus, then you are as safe as one could expect.

 

Despite vulnerabilities in whatever browser you choose to use, your firewall & antivirus are the real tools to detect

changes to your system and prevent invasion.

 

Therefore is it important to understand and configure both these tools correctly to offer maximum protection.

 

I have for years simply used ZoneAlarm (firewall) & AVG (antivirus) - both available for free - and found they have

protected my system without incident, but they have from time to time alerted me to threats which are dealt with

immediately.

 

Hope this helps some people.

 

(I've never used FireFox, but with so many people recommending it over IE, I do intend to give it a go at some stage)

[Conniff]

The last sentence saying users should upgrade to version 3 is superceded by vulnerabilities in that version and patches have also been issued, some of them 'critical'.

 

Firefox Patches 11 Security Vulnerabilities

[Mr Happy]

With Ie vulnerabilities are fitted as standard.

 

On the PCTools virus/spyware database there are something like 7 pages of threats listed for internet explorer, on firefox there are just 2 threats.

 

I know what im sticking with.