Welcome Guest | Sign In

Mozilla Beefs Up Security in Firefox 2.0

By Jay Lyman
Dec 21, 2006 4:00 AM PT

Mozilla released the first security reinforcements for Firefox 2.0, the latest version of its popular Web browser, providing users of the open source software with fixes for five critical and three minor security holes.

Mozilla Beefs Up Security in Firefox 2.0

Security has emerged as one of the most important aspects of browser software from Mozilla, Microsoft, Opera and others, as attackers increasingly take advantage of browser vulnerabilities to hook into the computers of unsuspecting Web surfers.

This week's patches address flaws that are indirectly related to security, Burton Group Vice President Craig Roth told LinuxInsider.

"They're security, but they're bug fixes to things that may affect security issues," he said, referring to social engineering attacks that aim to trick users rather than fooling the software.

Growth and Bugs

The security advantages of Firefox have helped it gain on Microsoft's Internet Explorer like no other competitor in years. However, even though it has been growing rapidly, it is still much smaller in market share and appeal to attackers than IE.

Microsoft dominates with more than 80 percent share. However, Firefox has passed the 12 percent mark and is now pushing toward 15 percent. The remainder is owned by Opera, Apple's Safari and other browsers.

Mozilla released Firefox 2.0 last October as Microsoft rolled its major browser upgrade to market with IE7. Both browsers focus on security, and both have suffered from bugs, flaws and security holes that come with all software, including a password theft vulnerability disclosed earlier this month.

Critical Fixes

In this week's security update, Mozilla addressed five vulnerabilities deemed "critical," two considered "high" impact, and one minor issue.

The critical issues include an SVG Processing Remote Code Execution, a LiveConnect crash finalizing JavaScript objects, and privilege escalation using watch point, Mozilla said.

Security firm Secunia issued an advisory on the Firefox vulnerabilities and a recommendation that users update to Firefox or

Social Security

Roth downplayed the significance of the Firefox security fixes, indicating Mozilla was not featuring the update prominently, nor was it urging users to download it.

The biggest security advantage of Firefox is its much smaller user base compared to Explorer, Roth said, suggesting that the latest updates are less important than how Mozilla deals with continuing and improving social engineering attacks, particularly phishing.

"It's an ongoing issue -- one that's more important to track than things like this," he said.

Facebook Twitter LinkedIn Google+ RSS
What's your alarm level over cyberattacks on the Internet's infrastructure?
Red: A deadly cyberwar will occur -- It's when, not if.
Orange: A big one could be costly and threaten public safety.
Yellow: We need to improve cybersecurity at a faster pace.
Blue: Regional outages will become more frequent and more annoying.
Green: There's no way anyone could take out the entire Internet.