Firefox 3.5.4 fixes critical memory flaws

Mozilla trotted out Firefox 3.5.4 yesterday, which patches 16 vulns - 11 of which were critical bugs. The browser maker said the 11 critical vulnerabilities were found in a number of components such as the JavaScript and browser engines, the GIF color map parser, the strings-to-number converter, three third party media …

[MarkOne]

Another day.

Another critical Mozilla security flaw. Sounds like IE all over again. The irony is that alot of these Firefox users switched from IE because Mozilla led them to believe their browser was more secure.

The number of IE updates I get these days is much less than new Firefox releases.

Then again, I only actually get IE updates because I have Windows, I don't actually use that. Opera is where it's at. Security, Stabilities Standards Compliance and cross platform data syncing including my mobile in one lovely package.

[Aidan Samuel]

Critical memory flaws?

Damn. And there was I, hoping they'd fixed the bit of code that eats up 250mb of ram.

;-)

[Tony Paulazzo]

Two Weeks

So, I installed Windows7 two weeks ago, fresh, and ran Secunia today, not expecting to find any problems. But no, Adobe flash already out of date, even though it installed a Firefox plugin, which I assumed would let me know about any updates released.

Stupid Adobe. I wish some one would release an alt Flash plugin, thank God for Noscript and Adblock.

At least Mozilla let you know when updates are available.

[Anonymous Coward]

seamonkey 2

seamonkey 2 is also out for those of us that like our apps in one place.

http://www.seamonkey-project.org/

[Anonymous Coward]

Remember kids...

This is the safest browser on the market.

[Anonymous Coward]

@Tony Paulazzo

You had me worried there for a minute!

According to http://www.adobe.com/software/flash/about/, the current version of Flash is 10.0.32.18, and that's been around since the end of July.

[asdf]

Firefox struggling under bloat

I have been a big Firefox advocate since before version 1 came out but lately not so much. I still use it when I need to log into important accounts as NoScript still offers the best protection against various web flaws that steal passwords. For promiscius browsing these days however I much prefer Chromium on linux because not only is it more secure from process exploits with sandboxing under AppArmor but it is a hell of lot faster on a netbook as well. As for the IE fanboi at the top I will admit M$ is trying to move in the right direction with IE8 but by long ago embedding browser code deep into the kernel space that ship has already sailed. Your browser should run with absolutely as few privledges as possible as it and its plugins are on most desktops the most vulnerable piece of software on the box.

[Saucerhead Tharpe]

MarkOne, do you know what a non-sequitur is?

Getting less IE (or Opera) patches is not a sign of fewer faults. The bonus of an Firefox is that where faults are found with code, then the fix arrives quicker and you get information about it.

[J 3]

Er...

"The number of IE updates I get these days is much less than new Firefox releases."

Could it possibly be because the flaws in IE are being ignored and/or not getting fixed? Duh...

(maybe yes, maybe no, of course -- I don't really care too much because I don't run Windows. I'm just making the point that some people jump at their preferred conclusions without any thought as to why things are they way they are)

And we could always use the good old "critical mass" argument against your preferred browser: nobody uses that, so of course nobody finds vulnerabilities. Security by obscurity, etc. Or not. Isn't it fun to play knee-jerk fanboi?

[Dick Emery]

Meh!

I'm already using Minefield despite being beta (Hey isn't all software in constant beta anyhow what with update after update?). Forced compatability mode and all is working fine. Reason for switching was you can now use a custom chrome profile to disable the annoying blurry images in the previous FF image scaling.

[Ian Ferguson]

How do they let us know?

"At least Mozilla let you know when updates are available"

Firefox never seems to let me know when an update is available, the Reg is normally where I hear, and have to manually tell Firefox to check for updates :(

I wish it would integrate with Windows Update and Apple Update, but both scenarios are probably pipedreams.

[Nigel 11]

@MarkOne - The difference between IE and FF

The difference is not that one is a bug-free program and the other isn't. ALL large programs have bugs.

The difference is that when bugs in Firefox are found, they get fixed quickly. When bugs in IE are reported to Microsoft, Microsoft has been known to sit on them doing nothing, until such time as either a security researcher publicises the bug, or evidence mounts that black hat hackers are actively expoliting it.

Also, Firefox is open-source, so lots of eyeballs have studied the code, meaning the obvious bugs were fixed long ago. Is that true of IE? Who knows, apart from an unknown number of MS employees and others who signed an NDA. Security by obscurity doesn't work.

[Rich Harding]

@MarkOne

"The number of IE updates I get these days is much less than new Firefox releases."

And that should make people feel more secure how exactly?

[Bug]

Bugs don't necessarily reflect security (or lack of)

"Another critical Mozilla security flaw. Sounds like IE all over again. "

You're either a troll or simply ignorant. Software has bugs. The number of updates for a product does not in anyway indicate how many bugs there is in it or how secure it is. The only things the updates to Firefox indicate is that bugs are being fixed, that Mozilla are open enough to admit these bugs existed and that Mozilla release updates as and when they feel necessary rather than to a fixed schedule (like making you wait until patch Tuesday). You also have to take in to account not only the number of bugs but how quickly they are fixed once they are discovered. On the former, Firefox is open source so anyone can find bugs and tell Mozilla about them, even send Mozilla a fix. IE is closed source, only Microsoft get to see the code and Microsoft don't need to tell you if they found a bug because they can patch it without anyone ever knowing.

Mozilla have a much better record on the latter than Microsoft.

[Gabor Laszlo]

@MarkOne

Indeed, Mozilla marks as critical and fixes memory leaks before they even become known, as opposed to Microsoft who just ignore them (and other problems) long after there's an exploit in the wild. But you're right, you do sound like someone who would be happier using Opera.

[Anonymous Coward]

Me too, Aidan Samuel

Firefox's memory greed has become absolutely ridiculous.

Mark One: you miss the point. Firefox is not better (than MS's IE) because vulnerabilities are never discovered, but because they are found, and fixed in a timely fashion

[Daniel Grey]

Hmmm..

Wonder if it will fix the random Firefox crashes that started when I went quad core at the weekend (CPU replacement only, no other hardware). It is the only software that has fallen over since.

[Anonymous Coward]

Fewer IE updates?

Bollocks!

Just fired up the missus' laptop and Vista pops up an updates available message.

28.4MB later and it installs two IE updates, a Vista platform update, and a Defender update.

Coincidence? I think not.

[Robert A. Rosenberg]

3.0.15 ALSO Got Issued

For those who are still at 3.0.x (who have not upgraded to 3.5 yet for reasons such as needed plug-ins not being issued for 3.5 yet) 3.0.15 was issued at the same time as 3.5.4 was. I have not compared the two fix lists but I think that at least some are on both lists due to being newly discovered exploits.

[Aortic Aneurysm]

Strange...

I'm running Firefox on my laptop at home, it's never crashed, always loads up within seconds and never slows down my system, and I've only had one update in about a month.

Still, Better not say that, as it doesn't follow the Firefox bashing trend.

[Defiant]

Lesson of the day, don't be fooled!

What you FF people seem to forget is FF wasn't built for Windows in mind so if you want speed and security don't fall for what the sheep tell you, either use Opera or Windows that are designed for Windows

[Tee]

oh dear, same on, same old.

fire fox, memory issue u say, how unusual