Mozilla has squashed their 27th security bug for the year on the Firefox browser. Late last night they released Firefox 2.0.0.6 that fixed two serious bugs, one of which also plagues Internet Explorer:
- Unescaped URIs passed to external programs [link]
- Privilege escalation through chrome-loaded about:blank windows [link]
Mozilla had just released Firefox 2.0.0.5 less than two-weeks ago to prevent Internet Explorer from inappropriately launching Firefox. Here is what I had previously said about the problem:
The new Firefox 2.0.0.5 fixes a critical flaw that enables a hacker to control a user’s computer. Ironically, this was done by letting the hacker launch Firefox through Internet Explorer, and then Firefox would run malicious instructions that could compromise their system.
…
It was recently discovered that Trillian is also affected when using the AIM portion, and it is expected that other applications are susceptible to the attack as well.
To the surprise of the Mozilla team, Firefox (prior to 2.0.0.6) was capable of doing the exact same thing that Internet Explorer was criticized for. A hacker could use Firefox to launch another application, and possibly run malicious instructions. Now there is even some speculation that the bug is not even the fault of the browser, but is actually a flaw in Windows. Man, I can’t remember the last time that no one would take responsibility for a security-related bug like this. Pretty soon they’ll probably be blaming the clock in the System tray for it. 
Aside from those fixes there were also a few minor patches thrown in, but nothing that is really significant. The update is available through the Firefox homepage, or by using the "Check for Updates" option located in the Help menu.
Thanks to MetaMan and CoryC for tipping me off on the release right after it happened!
Enjoyed the post? Subscribe to our feed to get a daily dose of CyberNet!
Tags: Firefox, Freeware, Software, Applications, Browser, Mozilla
Related Posts:
- Download Firefox Portable 1.5.0.6
- Firefox 1.5.0.3 Released With The Security Patch
- Firefox 2 Beta 2 Scheduled For Release Tomorrow
- Firefox 2 RC1 And Firefox 1.5.0.7 Release Dates
- Mozilla Prepares Automatic Updater For Firefox Users
Here is more information from about
Firefox Update.
From the post, “On July 10th, I posted about a security issue in URL protocol handling on Windows. In the previous example, Internet Explorer was the entry point and Firefox was the application receiving the bad data. Over the weekend, we learned about a new scenario that identifies ways that Firefox could also be used as the entry point. While browsing with Firefox, a specially crafted URL could potentially be used to send bad data to another application. We thought this was just a problem with IE. It turns out, it is a problem with Firefox as well. We should have caught this scenario when we fixed the related problem in 2.0.0.5.”
Thanks for the extra information, Cory…
The system tray clock? Don’t blame him, he’s been sober for a year now!
It was that dastardly utility manager… always popping up when you least expect it.
True that.
Firefox is sexy