X

Mozilla releases security updates

Updates to both old and new versions of Firefox and Thunderbird seek to address security and stability issues.

Candace Lombardi
In a software-driven world, it's easy to forget about the nuts and bolts. Whether it's cars, robots, personal gadgetry or industrial machines, Candace Lombardi examines the moving parts that keep our world rotating. A journalist who divides her time between the United States and the United Kingdom, Lombardi has written about technology for the sites of The New York Times, CNET, USA Today, MSN, ZDNet, Silicon.com, and GameSpot. She is a member of the CNET Blog Network and is not a current employee of CNET.
See full bio
Candace Lombardi
2 min read
Mozilla has released updates to its Firefox browser and Thunderbird e-mail client for Windows, Mac and Linux users, the organization announced Friday.

"Due to the security fixes, we strongly recommend that all Firefox users upgrade to these latest releases," Mozilla said in a post on its development site.

"This update resolves the location.hostname vulnerability and other security and stability issues," Mike Schroepfer, vice president of engineering at Mozilla, said in a statement.

The location.hostname vulnerability that Schroepfer referred to was the Firefox cookie flaw discovered by Michal Zalewski, an "ethical hacker" from Poland.

In mid-February, Zalewski posted his proof-of-concept on a mailing list for other security experts. His note said that a flaw in Firefox could allow hackers to set or change cookies, permissions for Web site settings and passwords, for their own purposes. A fix for the high-impact flaw was made by Firefox developers last week.

This update includes the patch for that fix, as well as a fix for the critical level flaw involving memory corruption that can lead to crashes. That flaw left people using JavaScript in their mail--a practice Mozilla "strongly discourages"--open to attacks.

"Thanks to the work of our contributors we have been able to address these issues quickly in order to minimize the security risk to Firefox users," Schroepfer said.

The update is available in 37 languages from the GetFirefox.com and GetThunderbird.com Web sites for 1.5.0.10 versions of Firefox and Thunderbird, as well as Firefox 2.0.0.2. It is also scheduled to be available as of late Friday afternoon by clicking "Check for Updates..." in the Firefox Help menu.