General discussion

Locked

Update your MOZILLA TODAY!!!!!

By mrafrohead ·
There is an update for Mozilla that was released today. It is very important to update your shtuff ;p

Here's the link:

http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/0.9.2/FirefoxSetup-0.9.2.exe

Sorry, I'm lazy and I don't do Tiny's, so if it doesn't work, plz remove the spaces.

I'm sure most of you out there already know about this and this post is rather redundant, BUT, I know someone didn't hear of it so that is the reason for my post.

Enjoy and happy safe surfing.

Mrafrohead

Here's the e-mail I got that showed me of the update:

------------------START--------------------------


yet another important message appeared at fd, but not at bugtraq:
http://seclists.org/lists/fulldisclosure/2004/Jul/0333.html
it leads to:
http://www.mozilla.org/security/shell.html

you guys must monitor fd :-P

it cost me$$ N months to turn off codeBase - a smiliar issue in IE, but mozilla made it in less than 24 hours. and, this proved drew's words at
http://umbrella.name/iebug.com/display-singlemessage.php?readmsg:bugtraq_message-2004070003

regards,

liudieyu

http://umbrella.name/

----------------------END----------------------

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Here's the official release from Mozilla.org.

by mrafrohead In reply to Update your MOZILLA TODAY ...

Mozilla Security Advisory
July 7, 2004

Summary: Windows shell: scheme exposed in Mozilla
Products: Mozilla (Suite)
Mozilla Firefox
Mozilla Thunderbird
Fixed in: Mozilla (Suite) 1.7.1
Mozilla Firefox 0.9.2
Mozilla Thunderbird 0.7.2


Description:
Windows versions of Mozilla products pass URIs using the shell: scheme
to the OS for handling. The effects depend on the version of windows,
but on Windows XP it is possible to launch executables in known
locations or the default handlers for file extensions. It could be
possible to combine this effect with a known buffer overrun in one
of these programs to create a remote execution exploit, although
at this time we have confirmed only denial-of-service type attacks
(including crashing the system in some cases).

Solution:
We urge people to install the patch available on mozilla.org or
install the latest version of the software.

http://www.mozilla.org/security/shell.html

-Dan Veditz
Mozilla Security Group

Collapse -

Thanks for the heads up

by TheChas In reply to Update your MOZILLA TODAY ...

Hi, thanks for the heads up.

If you have been away from TR for a while, you may not have noticed that they have pretty much fixed the URL bug.
In fact, you may notice that your pasted web links are now click-able!

They even support emoticons in postings.

Anyhow, I installed the updates and spread the word to a few friends that are using Mozilla and Firefox.

Did you notice that on the press release page you can click on a link that will install just the patch for the browser you are running?

Thanks again,

Chas

Collapse -

HOLY CRAP!!!

by mrafrohead In reply to Thanks for the heads up

Man, I can't believe that my list of posts has been put back.

They've been gone for MONTHS!!! So I replied to a bunch of stuff but wasn't able to follow it and monitor them unless they were up front...

Newho - I didnt' notice the update link. ;p Guess I shoulda paid better attention.

;p

Mrafrohead

Back to Security Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums