New Firefox Updates Eliminate Major Security Flaw
The "location.hostname" vulnerability potentially allowed hackers to tamper with authentication cookies for third-party sites, manipulating how Web sites are displayed and how they operate, Mozilla said.
"We strongly recommend that all Firefox users upgrade to this latest release," said Mike Schroepfer, vice president of engineering for Mozilla, in Mountain View, Calif.
"This update resolves the location.hostname vulnerability, and other security and stability issues. Thanks to the work of our contributors, we have been able to address these issues quickly in order to minimize the security risk to Firefox users."
The updates are available immediately in 37 languages, including French, German, Spanish, Italian and Japanese.
Other security fixes in the new versions, according to Schroepfer, include improvements to help protect against cross-site scripting attacks; an adjustment of Mozilla Network Security Services SSLv2 to stop buffer overflow; the fixing of XSS and local file access by opening blocked popups; the elimination of spoofing using custom cursor and CSS3 hotspot; and the elimination of information disclosure through cache collisions.
Firefox 1.5.0.x will be maintained with security and stability updates until April 24, 2007; however, all users are encouraged to upgrade to Firefox 2, Schroepfer said.
Users who already have Firefox 1.5.0.x or Firefox 2.0.0.x will receive an automated update notification within 24 to 48 hours, Schroepfer said. This update can also be applied manually by selecting "Check for Updates" from the Help menu starting later in the day on Feb. 23, Schroepfer said.