Software // Enterprise Applications
02:28 PM
Connect Directly
Repost This

Mozilla Issues Firefox Security Update

The update addresses 10 security advisories, three of which Mozilla classifies as critical.

Mozilla on Friday released Firefox, an updated version of the upstart browser that has won over roughly one out of every five Internet users worldwide.

The update addresses 10 security advisories, three of which Mozilla classifies as critical.

One of the critical advisories has to do with the way that images are handled on Web pages with designMode frames, an HTML property that allows Web documents to be edited. The vulnerability could potentially be exploited to steal a user's browsing history, crash Firefox, or execute arbitrary code. The second critical advisory has to do with memory corruption crashes in the browser engine used by Firefox and other Mozilla products like Thunderbird. The third outlines a flaw that could allow JavaScript privilege escalation and the ability to execute arbitrary remote code.

In its 2007 security report, Secunia analyzed a limited set of vulnerabilities that were disclosed publicly, before vendor notification, and found that Mozilla on average patched Firefox flaws more quickly than Microsoft patched holes in Internet Explorer.

Secunia's report also notes that Internet Explorer had fewer vulnerabilities than Firefox in 2007 (43 compared to 64). In December, Jeff Jones, security strategy director in Microsoft's Trustworthy Computing group, presented similar statistics to support his claim that Internet Explorer was more secure than Firefox.

Mike Schroepfer, Mozilla's VP of engineering, in a blog post dismissed the idea that vulnerability counts matter. Citing the absence of a public IE bug database, he said, "There is no way for anyone outside of Microsoft to confirm how many vulnerabilities ever existed in Internet Explorer."

One area where Firefox appears to best Internet Explorer is in the number of vulnerabilities reported in browser add-ons. There were six vulnerabilities reported in Firefox extensions and 339 vulnerabilities in ActiveX controls in 2007, according to Secunia. It should be noted, however, that browser add-ons are generally developed by third-party programmers, who are ultimately responsible for writing safe code.

Microsoft has been working to help developers write safer ActiveX controls, though in light of the large number of vulnerabilities cited by Secunia, its efforts leave something to be desired.

"If an independent software vendor discovers that they have shipped a vulnerable control, they can work with Microsoft to issue an update that disables that control," a Microsoft official said in an e-mail on Thursday. "Up until this time, has not been contacted directly by any company regarding the recent public reports of vulnerabilities in ActiveX controls."

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Elite 100 - 2014
Our InformationWeek Elite 100 issue -- our 26th ranking of technology innovators -- shines a spotlight on businesses that are succeeding because of their digital strategies. We take a close at look at the top five companies in this year's ranking and the eight winners of our Business Innovation awards, and offer 20 great ideas that you can use in your company. We also provide a ranked list of our Elite 100 innovators.
Twitter Feed
Audio Interviews
Archived Audio Interviews
GE is a leader in combining connected devices and advanced analytics in pursuit of practical goals like less downtime, lower operating costs, and higher throughput. At GIO Power & Water, CIO Jim Fowler is part of the team exploring how to apply these techniques to some of the world's essential infrastructure, from power plants to water treatment systems. Join us, and bring your questions, as we talk about what's ahead.