Mozilla, Opera Plug Security Holes

By Matthew Hicks  |  Posted 2004-08-05 Print this article Print

The browser makers release new versions of their software to fix a series of vulnerabilities, as Mozilla readies a new patch system for Firefox.

The Mozilla Foundation and Opera Software ASA have released updates to their Web browsers to fix a series of security vulnerabilities. Mozilla on Wednesday posted new versions of its Firefox browser, Thunderbird e-mail client and Mozilla suite that provide fixes to three issues. They include a newly reported critical vulnerability affecting multiple vendors software that uses the library for the Portable Networks Graphic (PNG) image format. The other two issues, as previously reported, were related to the handling of security certificates in the Mozilla browsers that, among other things, could allow an attacker to lull users into a false sense of security on a site.
Mozilla had said last week that fixes were forthcoming and decided to incorporate them in new versions of its browsers, said Chris Hofmann, the open-source groups director of engineering. The new versions are Mozilla 1.7.2, Firefox 0.9.3 and Thunderbird 0.7.3.
Separately this week, Opera released a new version of its browser, Opera 7.54, to fix a set of security issues. They included a critical vulnerability reported in an advisory from GreyMagic Software that could allow an attacker to gain read-access to a users files and folders as well as to track browsing history and steal cookies. According to its version notes, Opera also fixed a reported spoofing issue that could allow page content to be loaded without the site URL changing, along with another URL vulnerability. For insights on security coverage around the Web, check out Security Center Editor Larry Seltzers Weblog. Mozilla and Opera make the two most popular alternative browsers to Microsoft Corp.s Internet Explorer, which also has been plagued by security vulnerabilities. Mozillas Gecko rendering engine and code also serve as the underpinnings for the Netscape browser. For its part, Mozilla is planning to add a new security patch mechanism into its Firefox browser, Hofmann said. Firefox, still in technology preview releases, is expected to reach a full version release this year. For version 1.0, Mozilla is working on an automated process where users would be prompted when new security fixes are available and be able to instantly update browser components, Hofmann said. Also earlier in the week, Mozilla launched a bounty program to entice its users and developers to discover and report security vulnerabilities. Through its Security Bug Bounty Program, the Mountain View, Calif., foundation is offering $500 cash to users who report significant security bugs in Mozilla software. Linux vendor Linspire Inc. and Internet entrepreneur Mark Shuttleworth are funding the program. Check out eWEEK.coms Security Center at for the latest security news, reviews and analysis.

Be sure to add our security news feed to your RSS newsreader or My Yahoo page

Matthew Hicks As an online reporter for, Matt Hicks covers the fast-changing developments in Internet technologies. His coverage includes the growing field of Web conferencing software and services. With eight years as a business and technology journalist, Matt has gained insight into the market strategies of IT vendors as well as the needs of enterprise IT managers. He joined Ziff Davis in 1999 as a staff writer for the former Strategies section of eWEEK, where he wrote in-depth features about corporate strategies for e-business and enterprise software. In 2002, he moved to the News department at the magazine as a senior writer specializing in coverage of database software and enterprise networking. Later that year Matt started a yearlong fellowship in Washington, DC, after being awarded an American Political Science Association Congressional Fellowship for Journalist. As a fellow, he spent nine months working on policy issues, including technology policy, in for a Member of the U.S. House of Representatives. He rejoined Ziff Davis in August 2003 as a reporter dedicated to online coverage for Along with Web conferencing, he follows search engines, Web browsers, speech technology and the Internet domain-naming system.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel