ID: IRCNE2012061511
Date: 2012-06-06
According to “ComputerWorld”, Mozilla released Firefox 13, an upgrade that patched 13 vulnerabilities, including two critical flaws in the browser's update service.
Firefox also joined its rivals in finally adding a graphical "new tab" page that shows the most-frequent destinations.
Ten of the vulnerabilities patched Tuesday were rated "critical" by the open-source developer, while two were tagged "high" and one as "moderate." Mozilla uses a four-step threat scoring system, with critical the most dire.
Two of the critical bugs were in the updater and update service used by Firefox 12 on Windows, Mozilla acknowledged in an advisory.
Mozilla's description of the two vulnerabilities pointed to "DLL load hijacking" bugs, a category of Windows flaws first disclosed nearly two years ago.
In Firefox's case, the bugs could be used to load malware on the Windows PC -- assuming the hackers had local file system access through other means -- to gain additional rights on the victimized machine.
All but the two flaws in Firefox's updater and update service also applied to Firefox ESR (Extended Support Release), the longer-lived edition designed for enterprises that don't want to update workers' machines every six weeks. The current version of Firefox ESR is based on Firefox 10, which shipped in December 2011. ESR receives only security updates during its 54-week lifespan.
Mozilla no longer supports Firefox 3.6 with security updates: The company halted patches for that 2010 edition in April, when it also stopped serving updates for users running Windows 2000 and the earliest editions of Windows XP. Mozilla has recently took to automatically upgrading them to Firefox 12.
Firefox's new tab page -- which appears when the user creates a new tab -- got a much more dramatic overhaul. Previously a blank slate, the page now mimics other browsers by displaying thumbnails of the user's most-visited websites, selected from Firefox's history.
What's surprising is that Mozilla took so long to reach the same conclusion as its rivals. Apple's Safari, Google's Chrome, Microsoft's Internet Explorer (IE9) and Opera Software's Opera all feature a new tabs page with images of the most-visited sites.
Also new to Firefox 13 is default support of SPDY, for "speedy," a Google-crafted protocol that promises faster and more secure page loading, primarily to Google's own services, such as Gmail and Google+. Mozilla added support for SPDY in March's Firefox 11 but until today it was switched off by default.
- 2