About This Blog   |   Archives   |   RSS Feeds RSS Feed   (What's RSS?)

New Firefox Browser Fixes Seven Security Holes

Mozilla has shipped a new version of its popular Firefox Web browser to plug multiple security holes. The fixes embedded in the latest iteration of Firefox, version 2.0.0.5, are not included in older versions of Firefox (e.g., 1.5.x and lower), so those users will need to upgrade to the latest 2.0.0.5 release to be fully protected.

In all, Mozilla fixed at least seven security vulnerabilities in its latest release, including a flaw Security Fix wrote about last week that uses the Microsoft Internet Explorer browser to trick Firefox into opening up a variety of dangerous security holes.

Unless you are using a version of Firefox earlier than 1.5.x, you should soon be prompted to upgrade to the latest version. If this doesn't happen (it may take a few more hours for Mozilla to push out the auto-updates), you can always try upgrading by selecting "Help" and then "Check for Updates." Mozilla notes that some of your Firefox extensions (or "add-ons" as they're now called) might not work until updates for them are made available.

By Brian Krebs |  July 18, 2007; 10:36 AM ET New Patches
Previous: Your Money or Your Documents | Next: Not-So-Friendly Greeting Cards

Comments

Please email us to report offensive comments.



I use Firefox and find it far better than IE, great how a company can give such a splendid browser free, and microsoft charges a small fortune for its products, and it wouldn't be so bad if they worked properly, which they seldom do, the public do the research and development, and pay for it! probably thats the secret to becoming the richest man on the planet!

Posted by: John Tully | July 18, 2007 11:46 AM

Here are a couple of additional links that some folks may find helpful. The Release Notes for 2.0.0.5 are at:

http://www.mozilla.com/en-US/firefox/2.0.0.5/releasenotes/

The download page with all releases for Linux, Windows, and Mac OS X, in many languages, is here:

http://www.mozilla.com/en-US/firefox/all.html

(Getting the whole thing can make sense if you have several machines to update.)

Posted by: Rich Gibbs | July 18, 2007 11:49 AM

Just tired to down load the updates, but so far nothing is available. It would do a whole lot better, if these are first made available before the releases are announced.

Posted by: Jerath | July 18, 2007 12:10 PM

Just tired to down load the updates, but so far nothing is available. It would do a whole lot better, if these are first made available before the releases are announced.

Posted by: Jerath | July 18, 2007 12:12 PM

Counting by CVE numbers, it's actually nine.

_ryan

Posted by: _ryan | July 18, 2007 12:29 PM

Just tired to down load the updates, but so far nothing is available. It would do a whole lot better, if these are first made available before the releases are announced.

Posted by: Jerath | July 18, 2007 12:53 PM

As usual with Firefox, no problem downloading & installing these updates. The laptop came with autoupdate, and I manually requested the updates for the PC.

Now, why can't MS do the same thing? I am, BTW, still waiting for something *from Microsoft* on how to fix their disastrous latest patches. I have turned off those patches until I see there is a definitive fix, from MS, which hasn't happened yet.

BK - do you have any news on this?

Posted by: sc | July 18, 2007 1:00 PM

"great how a company can give such a splendid browser free"

Same business-model as Google in a way -- all ad-based.

Google's business is not really search but selling advertising: that's where its profits come from. See the sponsored links highlighted in yellow at the top of a returned search? They get a lot of revenue from that.

Mozilla doesn't sell its products; it sells the end-user's eyeballs. And mostly it's selling them to someone we've already mentioned: Google. If you use the search box in top right, you'll see when the search runs Mozilla's name is put in the URL. They get revenue for each search like that. Try searching on, say "camera" or "CD". The company/companies that bought the yellow box paid Google to get your eyeballs on their name and Google paid Mozilla for helping to support that business model through referring users from the search box.

Posted by: Mike | July 18, 2007 1:03 PM

Installed without incident.

They weren't offering me the update, so I downloaded the installer, checked the MD5 sum, uninstalled 2.0.0.4 and installed 2.0.0.5. Everything seems fine.

Posted by: Mike | July 18, 2007 1:05 PM

I don't like having to update Firefox because I have to fix a bug every time. It doesn't play nicely with limited user accounts: http://kb.mozillazine.org/Updates_reported_when_running_newest_version

Posted by: A | July 18, 2007 1:14 PM

@Mike -

Sure, they're paying for it...but I'm not paying for anything...and with Ad-block, I don't even see it...if they're offering a product that's as good as this is for free, then I wouldn't mind that they get paid for my searches...not one bit.

Posted by: Blockbuster | July 18, 2007 1:15 PM

I just "checked for updates" and the update installation took only a few seconds and installed without incident.

Posted by: Emily | July 18, 2007 1:23 PM

I'm using 2.0.0.4, just checked for updates from the Help menu and it says none are available.

Posted by: Ugh | July 18, 2007 1:44 PM

It seems that on the first try of 'check for updates' Firefox 2.0.0.4 finds nothing, but try it twice and it should work. The second 'check' worked for me on my two PCs.

Posted by: anonymous | July 18, 2007 2:00 PM

If you have Microsoft software on your computer, the dhs advises you to erase it immediately. (Homeland Terrorist color code: Hot Pink) Install Linux or BSD. Free software is worth paying for. Please donate to Mozilla or KDE or Ubuntu, or buy Suse.

Posted by: The Secret Diary of Bil Gates | July 18, 2007 5:47 PM

Or better yet, just use Opera. I was one of the earliest users of Firefox's predecessor, Firebird. I downloaded the original Firefox 1.0 within seconds of its release. I loved it and told everyone I knew about it. Now, I use Opera almost exclusively, even with Linux. Opera comes with all the tools I need and I never have to worry about add-on compatibility after a security upgrade. Plus, as even Steve Jobs pointed out in his introduction of Safari, Opera is the benchmark for speed.

Posted by: Tom | July 18, 2007 8:08 PM

@Jerath - you can't type right so does ADD have something to do with not being able to read paragraph 3 of 3
@Ugh - what's your reason?

not trying to be mean folks, but this was just a 3 paragraph blog - how could you take the time to post something, but not read 3 paragraphs?

Posted by: OhioMC | July 19, 2007 6:12 AM

I USE TO WRESTLE AND I LIKE THIS IDEA.
-THE CLOWN

Posted by: DOINK | July 19, 2007 12:02 PM

+++++++++++

BRIAN

WHAT IN BLAZES IS GOING ON OVER AT SYMANTEC ???

THIS IS THE SECOND TIME IN LESS THAN 3 WEEKS THAT SPYWARE DOCTOR IN DOING A SCAN DETECTED 'ONLY' 5 TROJANS IN MY REGISTER -- THAT OBVIOUSLY GOT BY MY CURRENT VERSION OF NORTON.

COMCAST IS NOW RECOMMENDING ITS USERS TO INSTALL MCAFEE'S FULL VERSION AND TO SCRAP NORTON.

IN DAYS GONE BY NORTON WOULD HAVE ALERTED ME TO ATTACKING TROJANS, BUT I HAVEN'T SEEN A MESSAGE LIKE THAT FOR MONTHS NOW.

AND LAST WEEK MICROSOFT TECH SUPPORT, AFTER THEIR 'TAKING COMMAND' OF MY COMPUTER USING THEIR REMOTE FEATURE DETERMINED MY VERSION OF XP HAD BECOME CORRUPTED -- SO BADLY, THAT WE HAD TO RE-FORMAT C AND THEN RELOAD ALL PROGRAMS AGAIN. FORTUNATELY, MY DATA ITSELF WAS SAVEABLE AND NOT CORRUPTED.

WHAT TO DO??? MCKASKY'S TRAIL EDITION ANTIVIRUS WAS SO COMPLEX THAT EVERY TIME I TRIED TO PUT ANOTHER PROGRAM ON, IT BLOCKED IT CLAIMING AN INTRUDER WAS TERYING TO BREAK INTO MY SYSTEM -- AND IT WAS VERY HARD TO GET OFF THE SYSTEM AS WELL.

SO, WHAT SAY YOU??? IS NORTON ABOUT TO WAKE UP, OR SHOULD I SWITCH ???

Posted by: BRUCEREALTOR@GMAIL.COM | July 22, 2007 6:35 AM

Brian, your Firefox update was posted Jul.18, and it states that Mozilla fixed the problem involving using IE to "Make Firefox do bad things".
So, why is Secunia still stating that this last hole isn't fixed, as late as Jul.27?

http://secunia.com/advisories/26201/

Although the advisory mostly covers Microsoft products, it does list Firefox 2.0.0.5.

A clarification would be appreciated, since other news outlets are also stating that Firefox has this flaw still open. ("search security", article of July 26 by Robert Westervelt).

superfreak77
-at-
gmail

Posted by: superfreak | July 27, 2007 12:20 PM

The comments to this entry are closed.

 
 

©  The Washington Post Company