Mozilla Closes Down Critical Security Holes
The Mozilla Foundation has just released Firefox version 2.0.0.10 which resolves three critical vulnerabilities – but new issues have already reared their ugly heads.
One of the most serious vulnerabilities concerned handling of .jar files. An error in the Jar protocol implementation allowed cross-site scripting attacks on filters and other safeguards to grab login information and other data. Another scenario describes attacks with carefully crafted archives. Redirects allowed attackers to exploit the vulnerability. The second error to have been removed was exploitable by setting the "window.location" to redirect HTTP headers and thus launch cross-site scripting attacks.
The third error originated from a memory management bug which attackers could exploit to crash the browser or execute malicious code on the victim’s system. These vulnerabilities also affect Mozilla Seamonkey, a new version of which (1.1.7) will become available in the next few days.
But shortly after version 2.0.0.10 of Firefox was released, the next crop of bugs was identified. US-based developer Kevin Han has reported a bug that prevents the browser from displaying graphics embedded using Javascript. The new version responds to the "canvas.drawImage()" instruction with an error message of "NS_ERROR_NOT_AVAILABLE"; instead of displaying vector graphics, the method now draws pixel images in them.
Despite the new bug, the Firefox developers still advise users to update to the new version of the browser. The Mozilla Foundation servers have versions in various languages with distribution packages due to follow in the next few days.
Issue 212/Features
Buy this issue as a PDF
News
-
GitLabs Drops Pricing after Microsoft, GitHub Acquisition
GitLabs is creating more incentives for users to switch from GitHub.
-
KDE Plasma 5.13 Is Here
The desktop environment is designed to be more resource efficient.
-
SUSE Forks Red Hat’s Spacewalk Project
SUSE relies heavily on the project for its own SUSE Manager.
-
openSUSE Leap 15 Announced
The release was announced at the openSUSE Conference in Prague, Czech Republic.
-
SoftMaker FreeOffice 2018 for Linux
SoftMaker Software GmbH has announced FreeOffice 2018, a free of cost office suite for Linux.
-
A New CentOS
Latest version of the community Linux based on Red Hat Enterprise Linux 7.5
-
Ubuntu 18.04 Released
“Bionic Beaver” comes with hardware-focused improvements and Gnome as the default shell.
-
Richard Stallman Calls Azure Sphere OS a Positive Step
Stallman is glad that Microsoft will respect user’s freedom.
-
Red Hat Enterprise Linux 7.5 Released
The latest release is focused on hybrid cloud.
-
Microsoft Releases a Linux-Based OS
The company is building a new IoT environment powered by Linux.