New Firefox 3.0 alpha blocks malware, secures plug-in updates
297679
Mozilla has released alpha 8 of its Firefox 3.0 Web browser, unveiling for the first time to users several security features it's talked up for months.
339220
Second beta version of the upcoming browser features an improved interface, phishing protection.
301034
Year-old bug pulls a fast on Firefox A researcher has demonstrated how a security bug in Apple's QuickTime media player that was disclosed a year ago can cause Firefox to install backdoors and other malware on a fully patched computer. He said both Windows and Mac systems are vulnerable.â¦
424439
10.3.7 fixes bugs, fills security holes
415939
Add-ons add security threat A security weakness in the update mechanism for third-party add-ons to the Firefox browser could give an attacker the ability to exploit unsecured downloads and install malicious code on the victim's computer, a security researcher warned on Wednesday.â¦
561018
It's raining security updates Mozilla pushed out a new update of Firefox on Thursday that fixes ten security vulnerabilities, three of which are deemed critical.â¦
416887
(InfoWorld) - Makers of some of the most popular extension software used by the Firefox browser are not doing enough to secure their software, a security researcher said Wednesday. The problem is that many widely used Firefox extensions, including toolbars from Google, Yahoo, and AOL, do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher who blogged about the issue on Wednesday. Soghoian is best known as the researcher who attracted the attention of the FBI late last year after publishing a tool that could be used to print fake boarding passes. The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the SSL Web protocol. SSL Web sites, which begin with "https://," use digital certificates to provide users with some level of assurance that they're not connecting with a fake server. Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled Web site, it is common for commercial extension-makers like Google to host their software on an unsecured site, Soghoian said in an interview. This leaves users vulnerable to a "man-in-the middle" attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension. It wouldn't be easy for an attacker to pull this off, however. In one scenario, the hacker would set up a malicious wireless access point in a public area where people are using wireless connections. He could then redirect extension update traffic to a malicious computer. "An attacker who sets up a wireless access point can then infect anyone who connects to it," Soghoian said. The Del.icio.us Extension, Facebook Toolbar, Ask.com Toolbar, LinkedIn Browser Toolbar, Netcraft Anti-Phishing Toolbar, and PhishTank SiteChecker are also vulnerable to this issue, Soghoian said. Though Soghoian said Firefox users should avoid extensions that are not from the secure Firefox add-ons site, not all security researchers see this as a major issue. "It's just yet another vulnerable design among billions,"said Gadi Evron, security evangelist for Beyond Security. "I don't see it as that critical. There is no inherent vulnerability, but it does make the over-whole design weaker, and that should probably be addressed" Evron said it was "silly" that sites weren't using SSL for these extensions. Soghoian said he notified Google, Yahoo, and Facebook of the issue in mid-April, but nobody had addressed the issue as of Wednesday. Just hours after Soghoian went public with his findings, Google said it would "soon" have a fix for the problem. It's common for Web developers to ignore security in the rush to push out new and cool features, Soghoian said. "Your average Web 2.0 developer doesn't learn about security," he said. "Google has a spectacular security team ... my suspicion is that one hand wasn't talking to the other."
74642
Mozilla Corp. has released the last planned alpha update to Firefox 3.0; the new browser moves to beta testing at the end of the month and is due out in final form by the end of the year.
514013
MyPhish.com The latest versions of both Firefox and Internet Explorer are vulnerable to an unpatched flaw that allows hackers to snaffle users' login credentials via automated phishing attacks.â¦
449251
Mozilla bumped up the threat ranking for an unpatched Firefox bug to "high," but promises a quick fix.
196884
A flaw in the pop-up blocker of the open-source browser Firefox could allow an attacker to access local files, according to security analysts.
592284
Update to free browser will warn people if a Web site looks like a phishing scam, its maker says.
220418
Mozilla disclosed Monday that it had opened up a vulnerability with a previous security fix for its Firefox, Seamonkey, and Thunderbird clients. According to an advisory issued Monday, a new JavaScript issue was introduced that would allow coding from Web content to be exploited to execute arbitrary code.
70158
Pop goes the weasel A vulnerability in Firefox's popup blocker software creates a means to read files from affected systems, security researchers warn.â¦
157244
New update for the Firefox browser could be pushed out soon.
241440
Blog: Patches include the Firefox portion of the IE-Firefox flaw identified last week.
453367
With the release of its latest Firefox 2.0.0.5 browser, the chief security officer at Mozilla says they have fixed a number of potentially serious vulnerabilities.