Browser maker provides package of add-ons for security focused Firefox users.
Mozilla pushed out a Firefox security update Friday, repairing nearly a dozen flaws that could enable an attacker to crash the browser or take complete control of a computer.
Firefox 3.0.14 and 3.5.3 fixes several critical vulnerabilities including a dangling pointer flaw reported via TippingPoint’s Zero Day Initiative that could allow an attacker to run malicious code on a victim’s computer. In addition a critical error in FeedWriter could be used by an attacker to run JavaScript code from Web content with elevated privileges, Mozilla said.
In addition Mozilla fixed nine memory corruption errors with the release of Firefox 3.0.14 and 3.5.3. The vulnerabilities resulted in crashes to the browser engine or the JavaScript engine.
Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
New security add-ons package
Mozilla is offering end users what is calls a Full Security Suite. What it has done is collected four security-oriented add-on tools that users can use to protect themselves from Web-based attacks.
- NoScript helps stop a click jacking attack by preventing unauthorized code from running within the browser.
- Better Privacy helps users concerned about their privacy to stop companies from tracking them using a new Flash-based cookies called Local Shared Objects (LSO).
- AddBlock does what the name implies. It blocks those annoying add banners.
- WOT or Web of Trust assigns color coding to more than 20 million websites based on the threat they pose. It can warn if you suddenly browse to a high risk site and even block inappropriate content for children.
The package is a nice start to highlight the tools, which have been available to end users for quite some time. The tools each come with their own unique set of issues. NoScript for example may block some website features and need tweaking from time to time. AddBlock could also pose that problem.
