Category Archives: Firefox

Firefox, Patches and updates

Firefox 18.0.2

1 Comment

The latest version of Firefox apparently fixes some Javascript stability issues.

On a related note: is it just me, or are the release notes for Firefox kind of messed up? Looking at the page for the latest release, I notice the following:

  • The version being discussed doesn’t appear anywhere at the top of the page, in any headings, or in the page title.
  • The first reference to the version is in the list of issues fixed in the What’s New section, but issues fixed in previous versions appear as well.
  • What does appear in the page headings is “Notes (First offered to release channel users on February 5, 2013)”. Apparently this is telling us that the version being discussed was released on that date. But again, it’s not clear what version we’re talking about, unless you look at the page’s URL, which includes “18.0.2”.
  • The link to a complete list of changes takes us to a page that lists changes going back several months, in previous versions. It’s a massive list, again with no version information, despite being on a page with a specific version in the URL.
  • Comparing the complete list of changes for version 18.0.2 with the the list for version 18.0.1 shows that they are in fact identical. You have to go back to version 17.x to find a different list.

Confusing. To make matters worse, among all the Mozilla blogs, press releases and other related Firefox information on the Mozilla site, I’ve so far been unable to find a mailing list, feed or any other resource that simply announces new Firefox versions. I have to find out about new versions from SANS.

Adobe, Firefox, Flash, Java, Security

Plugins will be safer in future versions of Firefox

Leave a comment

Presumably in response to the recent flood of Java vulnerabilities, the developers of Firefox (Mozilla) will be adding a new layer of security to all plugins, including the notororiously insecure Java, Flash and Adobe Reader.

Essentially, the new security will consist of additional prompts when plugins are triggered. So when a web site tries to run Java code, Firefox will prompt you to make sure you really want to allow the plugin to activate and run the Java code. You will be able to control which plugins and sites are affected.

Oracle/Sun recently made similar changes to Java itself, in an attempt to improve the overall safety of Java in web browsers. However, as security researcher Adam Gowdiak points out, those changes are ineffective: Java code can still run silently, bypassing the new safeguards. He writes:

… unsigned Java code can be successfully executed on a target Windows system regardless of the four Java Control Panel settings …
Our Proof of Concept code … has been successfully executed in the environment of [the] latest Java SE 7 Update 11 (JRE version 1.7.0_11-b21) under Windows 7 … and with “Very High” Java Control Panel security settings.

That said, recent … security “improvements” to Java SE 7 software don’t prevent silent exploits at all. Users that require Java content in the web browser need to rely on a Click to Play technology implemented by several web browser vendors in order to mitigate the risk of a silent Java Plugin exploit.

Firefox, Flash, Patches and updates

Firefox 17 released

Leave a comment

The latest version of Firefox includes some security improvements designed to help prevent malware infection via out of date versions of Adobe Reader, Adobe Flash and Microsoft Silverlight. Specifically, when Firefox tries to display content using those older plugins, it will prompt the user for confirmation.

Version 17 also includes the usual assortment of security, performance and other bug fixes.

Firefox, Security

Firefox 16.0 pulled due to vulnerability

Leave a comment

Update 2012Oct12: Version 16.0.1 of Firefox has just been released. The new version fixes the vulnerability that caused version 16.0 to be pulled from the Firefox download site yesterday. All users are encouraged to upgrade to 16.0.1 as soon as possible.

Firefox 16.0 has been removed from the Mozilla web site due to a new vulnerability. Users who have already upgraded to the new version should either downgrade to version 15.0.1 or exercise extreme caution before visiting any unfamiliar or suspicious web site. The new vulnerability makes it possible for web sites to access information that is normally protected by the browser.

Update 2012Oct12: No exploits using this vulnerability have yet been seen in the wild, but a proof of concept has been published. The POC demonstrates the vulnerability with a few lines of Javascript code that could be embedded on a web site. Now that this POC has been made public, it’s reasonable to assume that similar code will start appearing on hacked and malicious web sites in the very near future.