Firefox 2.0.0.5 Patches Critical Flaws

Mozilla on July 18 released Firefox 2.0.0.5, the latest update to the groups flagship browser. The update patches eight security vulnerabilities, three of them “critical” and two “high,” the group said.

Most existing Firefox 2 users will be alerted to the new version by the software update feature built into the browser. Firefox 2 users who “check for updates” manually (from the Help menu) will see a message saying “Firefox 2.0.0.5—It is strongly recommended that you upgrade Firefox as soon as possible.”

The Mozilla Security Advisories Web page lists eight patches, three of them critical (red) and two high (orange). The advisories are:

• MFSA 2007-25: XPCNativeWrapper pollution (moderate)
• MFSA 2007-24: Unauthorized access to wyciwyg:// documents (high)
• MFSA 2007-23: Remote code execution by launching Firefox from Internet Explorer (critical)
• MFSA 2007-22: File type confusion due to %00 in name (low)
• MFSA 2007-21: Privilege escalation using an event handler attached to an element not in the document (critical)
• MFSA 2007-20: Frame spoofing while window is loading (low)
• MFSA 2007-19: XSS using addEventListener and setTimeout (high)
• MFSA 2007-18: Crashes with evidence of memory corruption (critical)

/zimages/1/28571.gifRead the full story on DesktopLinux.com: Firefox 2.0.0.5 Patches Critical Flaws

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.