Firefox, Thunderbird, SeaMonkey Get a Security Overhaul

PC Magazine ^ | June 1, 2007 | Lisa Vaas

[Zakeet]

The Mozilla Foundation has released security updates to fix multiple flaws that could result in system hijacking in its open-source Firefox browser, Thunderbird e-mail client and SeaMonkey Internet applications suite.

The bugs, deemed critical, are detailed in Mozilla's Security Advisory 2007-12. They include multiple vulnerabilities in Mozilla's Layout Engine and in its JavaScript engine that can result in memory corruption and lead to system takeover or DoS (denial of service). The function of a layout engine is to handle content such as HTML, XML, image files and applets as well as formatting information including CSS (Cascading Style Sheets) and presentational HTML tags. The layout engine displays the formatted content on-screen, filling in the browser's content area.

Firefox users who don't install the ANI patch are in danger of files being overwritten in an attack, given that the browser lacks a low-privilege mode.

According to Mozilla's advisory, the impacts of the vulnerabilities vary. "Some of these crashes that showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code," the advisory says.

Mozilla fixed the Layout Engine bugs in these updates: Firefox Versions 2.0.0.4 and 1.5.0.12.

[CedarDave]

I downloaded the latest Firefox, but I didn't see an upgrade for Thunderbird, which still shows up on the site as being version 2.0.0.0. Is there a secret handshake for upgrading thunderbird?

Interesting... I use Thunderbird 1.5.0.12 which updated for security issues on May 30:
http://www.mozilla.com/en-US/thunderbird/releases/1.5.0.12.html

However I also see a reference to Thunderbird 2.0.0.0 which appears to be a newer release but could be just a beta. It does not show any updates:
http://www.mozilla.com/en-US/thunderbird/

Think I'll stick with version 1.5 for a while.

[CedarDave]

Found another reference to Thunderbird:

Thunderbird 1.5: This version of Thunderbird will be supported until October 18, 2007 with security and stability updates. We strongly encourage all users to upgrade to Thunderbird 2.

Unsupported versions of Thunderbird for other platforms are also available.

[CholeraJoe]

Just checked. I'm running the updated version of Fartface Firefox.

[CedarDave]

One more note. As of last month (May) Thunderbird 2.0 had some bugs. Check out this Thunderbird Forum thread, especially the May 18th post:

http://forums.mozillazine.org/viewtopic.php?t=550079

[zeugma]

Thanks. I’ve been on 2.0 pretty much since it was released. Seems to work o.k. for me. Then again, I have 95% of my spam filtering happening at my email provider.