Firefox security update

Paul K · 20-10-2004, 14:22

Did anyone else get told to download a patch today?
http://forums.mozillazine.org/viewto...c8cd9940abfb42
I know I did at work (don't like being restricted to IE set up the way they have it

)

Quote:

On October 1, the Mozilla Foundation released a security update for Mozilla Firefox.

The vulnerability
Trying to save a file from data: protocol deletes every file in the destination directory that is not marked read-only. Combined with Firefox automatically downloading files to a user specified location, this can result in loss of data. [Details...]

Before Installing the update
* Make sure that you allow web sites to install software. To enable this, open the Firefox Preferences or Options window, select "Web Features", and make sure "Allow web sites to install software" is ticked.

* Linux users in particular: make sure that you can write to the directory where Firefox is installed. This may require you to run your browser as root. If you can not write to the directory where Firefox is installed, this update will fail.

Installing the update
The Firefox update notification should tell you that there is an update available. If it does, simply click on it to install the update.

If you are not automatically notified, or have switched notifications off, you can manually check for updates. To do this, open the Firefox Preferences or Options window, select "Advanced", select "Software Installation" if the item is not already expanded, and click "Check Now".

You can also do a manual installation. To do this, save the patch to disk (Right-click -> Save Link Target As) and then drag it to any open Firefox window.

After Installation
After installing this update, restart Firefox. If Firefox still shows the critical update notification (next to the throbber), checking for updates again should clear it.

Nightly build users
If you are using a nightly build of Mozilla Firefox, either update to a build from September 30 or later, or install the update as described above.

Verifying the update is installed
To verify that the update is installed, open Help -> About. The useragent of your browser is shown at the bottom of this window. If it ends with Firefox/0.10.1, the update is installed.

Notes
* If Firefox insists that there is a critical update available after installation, open about:config and reset the following preferences:

app.update.updatesAvailable
update.severity

* If you can not install the update, you can download a new build of Mozilla Firefox that already contains it.

* Installing this update will not break any localizations. If your browser is in German, for example, it will still be in German after the update.

* If you are using a modified useragent, you obviously cannot use Help -> About to check if the update is installed. In this case, check that bug259708.js is present in the default\pref directory of your Firefox installation.

**Chris** · 20-10-2004, 14:25

Darned helpful and efficient, these Mozilla people

Paul K · 20-10-2004, 16:52

Effiecient? Well they released the patch on the 1st and I got the prompt to install it today on the works pc

Oh well, it's installed now lol

keithwalton · 20-10-2004, 17:30

I seem to remember getting proded to update on both my machines around about that date

It popped up with somthing top right saying critical update avaliable when i hovered over it.
What ver of FFox are you using ?

Paul K · 20-10-2004, 17:36

The latest but since I have to use what ever pc is available it's likely that I haven't used that one for a couple of weeks lol
*edit*
By the way, anyone else read this?
http://www.neowin.net/comments.php?i...=main#comments
sorry about linking to another forum but I don't want to copy and paste the entire thing over.

Richard M · 20-10-2004, 21:11

Quote:

Originally Posted by Paul

Effiecient? Well they released the patch on the 1st and I got the prompt to install it today on the works pc

Oh well, it's installed now lol

I installed it the day after because I read all the Moz sites.

Mal · 20-10-2004, 21:19

Paul, is it not the same update that you told us about?

Paul K · 21-10-2004, 06:23

Quote:

Originally Posted by Mal

Paul, is it not the same update that you told us about?

Actually it is

which is very strange as it seems that the pcs at work aren't updating themselves properly. Think I will have to make sure I log into each one at least once a week to make sure any updates are done.
*Waits for thread closure due to duplication

*

**Chris** · 21-10-2004, 09:58

Quote:

Originally Posted by Paul

Actually it is

which is very strange as it seems that the pcs at work aren't updating themselves properly. Think I will have to make sure I log into each one at least once a week to make sure any updates are done.
*Waits for thread closure due to duplication

*

You'll have a long wait - I'm leaving it here to make sure everyone knows those Mozilla people really are helpful and efficient.

I wondered why my browser wasn't warning me of an update when I got home after reading this thread ... answer: because I got the update weeks ago when it came out

basa · 21-10-2004, 12:50

Updates required ?? Didn't notice them ?

Oh sorry .. I use

|
|
V

Paul K · 21-10-2004, 12:52

Quote:

Originally Posted by basa

Updates required ?? Didn't notice them ?

Oh sorry .. I use

|
|
V

Avant and Opera?
Mmmmmm

Quote:

Secunia Research has discovered two vulnerabilities in Maxthon, which can be exploited by malicious web sites to obtain sensitive information and spoof dialog boxes.

1). Inactive tabs can launch dialog boxes so they appear to be displayed by a web site in another tab. This can be exploited by a malicious web site to show a dialog box, which seems to originate from a trusted web site. Successful exploitation would normally require that a user is tricked into opening a link from a malicious web site to a trusted web site in a new tab.

Browsers:

* Konqueror
* Mozilla / Mozilla Firefox
* Opera
* Netscape
* Avant
* Maxthon
* Safari

2). Inactive tabs can gain focus from form fields on web sites in another tab. This can potentially be exploited to collect sensitive data entered in form fields on other web sites. Successful exploitation would normally require that a user is tricked into opening a link from a malicious web site to a trusted web site in a new tab.

Browsers:

* Mozilla / Mozilla Firefox
* Netscape
* Avant Browser
* Maxthon

**Chris** · 21-10-2004, 12:52

Quote:

Originally Posted by basa

Updates required ?? Didn't notice them ?

Oh sorry .. I use

|
|
V

Oi, go and start your own spam thread

basa · 21-10-2004, 12:56

Quote:

Originally Posted by Paul

Avant and Opera?
Mmmmmm

Actually Avast which is an AV s/w prog

Opera displays the true URL of any link when you hover mouse over it

Useful for IDing phishers !

basa · 21-10-2004, 12:59

Quote:

Originally Posted by Chris T

Oi, go and start your own spam thread

Nah, I like to play the smug git and hijack Firefox threads

(Someday I'll come a cropper :o )

Richard M · 21-10-2004, 15:22

Quote:

Originally Posted by basa

Actually Avast which is an AV s/w prog

Opera displays the true URL of any link when you hover mouse over it

Useful for IDing phishers !

So can Firefox, in fact you can disable any part of Javascript that you don't want.
And you don't really have an about:config or about:plugins in your browser do you hmm?