Netscape released a patch Monday designed to fix two “critical” security flaws in its browser, and another patch will soon follow to fix “a handful” of less critical problems in the near future.
“There were a few dozen other bug fixes that occurred in that [patch] as well,” Netscape spokesperson Andrew Weinstein said.
The Netscape 8.0.3.1 update repairs two security flaws in Firefox, the open-source browser on which Netscape is based. The first fixes a hole found in several media players, such as Flash and Quicktime, and how they open Javascript URLs within the browser.
Before the patch, these could be exploited to run malicious code that collects personal information such as login cookies or passwords. The other fix focuses on shared function objects, which could allow Web content scripts to locate a privileged object and then execute malicious code.
Weinstein said other fixes include another Firefox issue in which oversized images can cause the system to crash. Another fixes a frame injection vulnerability in Internet Explorers Trident rendering engine, which is not a problem for IE users but is for browsers such as Netscape that support tabbed browsing.
Weinstein said the “Set as Wallpaper” bug reported by security firm Secunia, which could trick users into setting a Javascript URL as the background image and execute malicious code, has not been addressed with this patch.
Secunia and the French Security Incident Response Team, along with Netscape, called these fixes “critical.”
After its release in May, Netscape 8 has gone through several rounds of patches. The first came a day after its release, when Netscape had to rush to patch several security holes in the initial version. AOL said the oversight was due to incorrect information from an external security vendor that said the security flaws did not affect the Netscape code.
The second round of fixes came at the end of May, when AOL confirmed that a bug in the new version corrupted certain XML configurations in the Internet Explorer browser. Microsoft recommended that users should avoid the bug by uninstalling Netscape. AOL countered and said the patch would fix the problems and there was no need to uninstall the browser.
Weinstein said the patch would be rolled out automatically for all Netscape users on Tuesday afternoon.
Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.