A report by Secunia finds the vulnerabilities in Mozilla Firefox greatly outnumbered those in Internet Explorer, Apple Safari and other browsers in 2008. However, Mozilla was quicker to react than Microsoft when dealing with vulnerabilities disclosed publicly without prior vendor notification, Secunia says.Mozilla's Firefox Web browser has been gaining market share against
Microsoft Internet Explorer for years now. However, in 2008 it surpassed IE in
a far less glorious category: number of bugs.
According to browser
vulnerability research by Secunia, (PDF) 115 security vulnerabilities in
Firefox were reported in 2008nearly twice as many as IE and Apple Safari
combined. However, the news is not all bad, as the same report showed that
Mozilla was much quicker to respond than Microsoft when flaws were publicly
disclosed either prior to or without vendor notification.
Three Firefox vulnerabilities were publicized last year under those
conditions. All three were patched, with the longest patch taking 86 days to
arrive, according to Secunia. For IE, however, only three of the six such vulnerabilities
were patched as of Dec. 31. One of the IE vulnerabilities remained
open for 294 days in 2008, according to the report.
The report noted that not all vulnerabilities are created equal. The three
aforementioned Firefox flaws were rated "less critical," while the
Microsoft vulnerabilities were more of a mixed bag. The three unpatched IE
flaws were rated either "not critical" or "less critical."
Two of the patched bugs were classified as "moderate" and "high,"
while the third patched bug was considered "less critical."
On March 4, Mozilla
released an update plugging eight security holes in Firefox 3.07, of which six were rated critical. The
vulnerabilities affect the browser's garbage collection, PNG
libraries, layout and JavaScript engines.
The critical vulnerabilities could enable hackers to run arbitrary code. But
there is also a vulnerability rated "high" that could allow a
Web site to use nsIRDFService and a cross-domain redirect to steal private data
from users authenticated to the redirected Web site.
The update came a day after Opera Software issued a security update for
its browser, and roughly a week after Apple released a beta version of Safari
4.
 |