Security threats Toolkit

Mozilla releases security fixes

Candace Lombardi CNET News.com

Published: 26 Feb 2007 09:03 GMT

Mozilla has released updates to its Firefox browser and Thunderbird email client for Windows, Mac and Linux users, the organisation announced on Friday.

"Due to the security fixes, we strongly recommend that all Firefox users upgrade to these latest releases," Mozilla said in a post on its development site.

"This update resolves the location.hostname vulnerability and other security and stability issues," Mike Schroepfer, vice president of engineering at Mozilla, said in a statement.

The location.hostname vulnerability that Schroepfer referred to was the Firefox cookie flaw discovered by Michal Zalewski, an "ethical hacker" from Poland.

In mid-February, Zalewski posted his proof-of-concept on a mailing list for other security experts. His note said that a flaw in Firefox could allow hackers to set or change cookies, permissions for website settings and passwords, for their own purposes. A fix for the high-impact flaw was made by Firefox developers last week.

This update includes the patch for that fix, as well as a fix for the critical level flaw involving memory corruption that can lead to crashes. That flaw left people using JavaScript in their mail — a practice Mozilla "strongly discourages" — open to attacks.

"Thanks to the work of our contributors we have been able to address these issues quickly in order to minimise the security risk to Firefox users," Schroepfer said.

The update is available in 37 languages from the GetFirefox.com and GetThunderbird.com websites for 1.5.0.10 versions of Firefox and Thunderbird, as well as Firefox 2.0.0.2. It is also scheduled to be available as of late Friday afternoon by clicking "Check for Updates..." in the Firefox Help menu.