Mozilla updates fix highly critical security flaws
Published: 18 Dec 2008 18:03 GMT
Mozilla has released updates to its popular Firefox browser, Thunderbird email client and SeaMonkey application suite, aiming to address highly critical security flaws that could expose users' sensitive information.
Users are advised to update to version 3.0.5 of Firefox, which was released on Tuesday. They are also advised to update to version 2.0.0.19 of Thunderbird and version 1.1.14 of SeaMonkey.
The vulnerabilities were found in earlier versions of Firefox 3, as well as in versions of Firefox 2.
According to a research note released on Wednesday by security researcher Secunia:
"Some vulnerabilities have been reported in Mozilla Firefox which can be exploited by malicious people to bypass certain security restrictions, disclose sensitive information, conduct cross-site scripting attacks or potentially compromise a user's system.
- Errors in the layout and JavaScript engines can be exploited to corrupt memory and potentially execute arbitrary code
- An error when processing the 'persist' XUL attribute can be exploited to bypass cookie settings and uniquely identify a user in subsequent browsing sessions
- Multiple errors can be exploited to bypass the same-origin policy, disclose sensitive information, and execute JavaScript code with chrome privileges"
One Mozilla advisory addresses critical security flaws in all three programs (Firefox, Thunderbird and SeaMonkey) that could arise from memory corruption and result in malicious attackers launching arbitrary code from users' computers.
Mozilla also noted that another set of critical vulnerabilities in all three programs could redirect users from a legitimate site to a malicious one, where users' private data could be stolen. A third set of critical flaws noted in all three programs could lead to the launching of arbitrary JavaScript within a different website.
Credit: Mozilla patches highly critical security flaws from CNET News
Did you find this article useful?
2 out of 2 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
