OpManager: A single console to manage your complete IT infrastructure. Click here for a 30-day free trial.
Welcome Guest | Sign In

Mozilla Beefs Up Security in Firefox 2.0

By Jay Lyman
Dec 21, 2006 4:00 AM PT

Mozilla released the first security reinforcements for Firefox 2.0, the latest version of its popular Web browser, providing users of the open source software with fixes for five critical and three minor security holes.

Mozilla Beefs Up Security in Firefox 2.0

Security has emerged as one of the most important aspects of browser software from Mozilla, Microsoft, Opera and others, as attackers increasingly take advantage of browser vulnerabilities to hook into the computers of unsuspecting Web surfers.

This week's patches address flaws that are indirectly related to security, Burton Group Vice President Craig Roth told LinuxInsider.

"They're security, but they're bug fixes to things that may affect security issues," he said, referring to social engineering attacks that aim to trick users rather than fooling the software.

Growth and Bugs

The security advantages of Firefox have helped it gain on Microsoft's Internet Explorer like no other competitor in years. However, even though it has been growing rapidly, it is still much smaller in market share and appeal to attackers than IE.

Microsoft dominates with more than 80 percent share. However, Firefox has passed the 12 percent mark and is now pushing toward 15 percent. The remainder is owned by Opera, Apple's Safari and other browsers.

Mozilla released Firefox 2.0 last October as Microsoft rolled its major browser upgrade to market with IE7. Both browsers focus on security, and both have suffered from bugs, flaws and security holes that come with all software, including a password theft vulnerability disclosed earlier this month.

Critical Fixes

In this week's security update, Mozilla addressed five vulnerabilities deemed "critical," two considered "high" impact, and one minor issue.

The critical issues include an SVG Processing Remote Code Execution, a LiveConnect crash finalizing JavaScript objects, and privilege escalation using watch point, Mozilla said.

Security firm Secunia issued an advisory on the Firefox vulnerabilities and a recommendation that users update to Firefox or

Social Security

Roth downplayed the significance of the Firefox security fixes, indicating Mozilla was not featuring the update prominently, nor was it urging users to download it.

The biggest security advantage of Firefox is its much smaller user base compared to Explorer, Roth said, suggesting that the latest updates are less important than how Mozilla deals with continuing and improving social engineering attacks, particularly phishing.

"It's an ongoing issue -- one that's more important to track than things like this," he said.

Facebook Twitter LinkedIn Google+ RSS
What do you think about Hillary Clinton's use of private email servers during her term as Secretary of State?
She broke the law and should go to jail.
She violated guidelines -- the issue is overblown.
She placed important state department information at risk.
Her servers might have been more secure than the government's.
I really don't care one way or the other.