Firefox 6 patches 10 dangerous security holes

Mozilla has shipped a critical Firefox update to fix at least 10 security vulnerabilities, some serious enough to expose web surfers to drive-by download attacks.

According to an advisory from the open-source group, 8 of the 10 vulnerabilities are rated “critical,” meaning that they can be used to run attacker code and install software, requiring no user interactionbeyond normal browsing.

Here’s a glimpse of the critical issues:

Mozilla identified and fixed several memory safety bugs in the browser engine used in Firefox 4, Firefox 5 and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

These include a WebGL crash, a JavaScript crash, a crash in the Ogg reader, memory safety issues and unsigned scripts.  These all affected Firefox 4 and 5.

Mozilla also credited researcher Michael Jordon of Context IS  with reporting a pair of critical issues — that an overly long shader program could cause a buffer overrun and crash in a string class used to store the shader source code; and a potentially exploitable heap overflow in the ANGLE library used by Mozilla’s WebGL implementation.

Some additional security problems fixed:

• Security researcher regenrecht reported via TippingPoint’s Zero Day Initiative that a SVG text manipulation routine contained a dangling pointer vulnerability.
• Mike Cardwell reported that Content Security Policy violation reports failed to strip out proxy authorization credentials from the list of request headers. Daniel Veditz reported that redirecting to a website with Content Security Policy resulted in the incorrect resolution of hosts in the constructed policy.
• nasalislarvatus3000 reported that when using Windows D2D hardware acceleration, image data from one domain could be inserted into a canvas and read by a different domain.

Firefox 6 is being distributed via the browser’s automatic update mechanism.

Source: zdnet

Why wait until tomorrow, when you can download Firefox 6 today

Although not due to be officially released until tomorrow, Mozilla has placed Firefox 6 Final on to its download servers. The latest version of Mozilla's open-source browser -- the third major release in five months -- sports a brand new Permissions Manager, which allows users to set privacy controls on a site-per-site basis.

Developers can make use of a new scratchpad window for testing Javascript snippets, while domain names are highlighted in the Address bar to aid identification of websites. Other changes are mostly beneath the hood, designed to improve compatibility, performance and security.

Firefox 6, which will be officially unveiled tomorrow, currently launches to a window telling you that you're running a beta version. Once the app is officially launched this should subsequently point to a new page introducing you to the latest version.

Its most notable new feature is the new Permissions Manager. This is accessible by typing about:permissions into the Address Bar, and allows you to set up customised privacy settings for individual websites. These cover passwords, cookies, pop-up windows, offline storage and shared location settings. A global setting for all non-configured sites is also available, making it possible to set up highly restricted settings for unknown websites to improve privacy and security.

Other visible changes include a subtle change to the way URLs are displayed in the Address Bar, with the main domain highlighted to make it more obvious which site you're on, allowing users to confirm the identity of sites visited through clicking links. Developers will find the new Javascript Scratchpad window accessible by clicking the Firefox button or opening the Tools menu (Mac) and choosing Web Developer > Scratchpad.

Most of the improvements in Firefox 6 are behind-the-scenes, with performance improvements of up to 20 per cent over Firefox 5 being debated. Add-on compatibility is now tested automatically by a plug-in checker, while WebSockets are now supported and HTML compatibility is extended further.

With the move of version 6 to the release channel, expect Firefox 7 to switch from Aurora to Beta, with Firefox 8 taking its place in the Aurora channel shortly. Firefox 7 will finally take steps to address the memory leak problem that has plagued Firefox, while version 8 should see major changes to the way add-ons are installed and updated, with silent installs blocked and users having to manually select which add-ons are retained from previous versions.

Firefox 6 Final is available as a free, open-source download for Windows, Mac and Linux.

Firefox 6 available ahead of official launch

Eager to get your hands on the next version of the Firefox browser?  Mozilla is scheduled to officially launch the browser on Tuesday, but you can get your hands on it now … if you know where to look!

… and I just happen to know where to look!

• Windows
• Mac
• Linux

Ignore the ‘first run’ screen that appears telling you that this is a beta … this is normal and Mozilla won’t change this page until the official release.

There are a lot of changes made under the hood. For example, startup is faster as users can choose whether or not to load all the tag groups or not.

Another interesting change is the way Firefox shows URLs in the address bar. Domain names are now highlighted to make it it easier to see where you are on the web.

There’s also a new permissions tool that allows users to set site-specific permissions for things like saved passwords, cookies, popups and so on. Just type about:permissions into the address bar.

So, if you’re interested, hit one of the links above and grab a copy. If anyone asks, say a friend sent you.

Source : zdnet

Firefox 6 breaks out ahead of schedule, gets official August 16th

It looks like the sly fox is ready to make its worldwide debut a few days early. In typical Mozilla fashion, a complete build of Firefox 6 is now unofficially available for your downloading pleasure, three days ahead of schedule. If you're looking for a major facelift to the desktop edition, you won't find one here -- most of the new features aren't cosmetic. Perhaps most visibly, you'll find the domain name of the page you're parked on highlighted in the address bar. On the Android side, version 6 makes much bigger promises, like a "fresh visual style in Chrome Gingerbread," enhanced image scaling, and, perhaps most importantly, it's "faster and uses less memory." We've downloaded the desktop version of the browser ourselves, and we've found the release quite snappy. If you're not afraid of a little pre-release downloading, you can catch the (desktop) fox at the source links below. And as per usual, please let us know how it's treating you.

Source : Mozilla