≡ Menu

mozilla firefox

Download of the day: OpenBSD 4.6 CD ISO Images

OpenBSD 4.6 has been released and available for download from the official website. OpenBSD is well known for record of more than ten years with only two remote holes in the default install. The OpenBSD is widely known for the quality open source code and documentation, uncompromising position on software licensing, and focus on security and code correctness.
[click to continue…]

Mozilla Asks To Display Firefox EULA In Ubuntu Linux

A software license agreement is a contract between a producer and a user of computer software which grants the user a software license. Most often, a software license agreement indicates the terms under which an end-user may utilize the licensed software, in which case the agreement is called an end-user license agreement or EULA. EULA is very common under Windows and other oses like Mac OS X.

A free software license grants the right to modify and redistribute the licensed software for any purpose, both of which would ordinarily be forbidden by copyright law. So you get considerably more rights than most EULAs provide. Now Mozilla asked Ubuntu to display EULA first time you launch Firefox. From the bug page:

Mozilla Corp asked that this be added in order for us to continue to call the browser Firefox. Since Firefox is their trademark, which we intend to respect, we have the choice of working with Mozilla to meet their requirements, or switching to an unbranded browser.

I don't see a big deal here. If you don't like EULA in Ubuntu, try Iceweasel - rebranded version of the Mozilla Firefox program.

Mozilla hat issued important security update for Firefox package that that fix various security issues are now available from Mozilla, Red Hat, and other distributions. Mozilla announced Firefox 2.0.0.15 security and stability update available for download. This update has been rated as having critical security impact by the Mozialla. All Mozilla Firefox users should upgrade to this updated package, which contains backported patches that correct many issues.

How do I update FireFox 3.x or 1.5.x or 2.x under Red Hat / CentOS Linux?

Simply type the following command at a shell prompt:
# yum update

How do I update Firefox under Debian / Ububtu Linux?

Open terminal and type the following commands:
$ apt-get update
$ apt-get upgrade

After a standard system upgrade you need to restart Firefox to effect the necessary changes.

Security Issues Details

From the CVE database:
Various flaws were discovered in the browser engine. By tricking a user into opening a malicious web page, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2798, CVE-2008-2799)

Several problems were discovered in the JavaScript engine. If a user were tricked into opening a malicious web page, an attacker could perform cross-site scripting attacks. (CVE-2008-2800) Collin Jackson discovered various flaws in the JavaScript engine which allowed JavaScript to be injected into signed JAR files. If a user were tricked into opening malicious web content, an attacker may be able to execute arbitrary code with the privileges of a different website or link content within the JAR file to an
attacker-controlled JavaScript file. (CVE-2008-2801)

It was discovered that Firefox would allow non-privileged XUL documents to load chrome scripts from the fastload file. This could allow an attacker to execute arbitrary JavaScript code with chrome privileges. (CVE-2008-2802)

A flaw was discovered in Firefox that allowed overwriting trusted objects viaozIJSSubScriptLoader.loadSubScript(). If a user were tricked into opening a malicious web page, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2803)

Claudio Santambrogio discovered a vulnerability in Firefox which could lead to stealing of arbitrary files. If a user were tricked into opening malicious content, an attacker could force the browser into uploading local files to the remote server. (CVE-2008-2805)

Gregory Fleischer discovered a flaw in Java LiveConnect. An attacker could exploit this to bypass the same-origin policy and create arbitrary socket connections to other domains. (CVE-2008-2806) Daniel Glazman found that an improperly encoded .properties file in an add-on can result in uninitialized memory being used. If a user were tricked into installing a malicious add-on, the browser may be able to see data from other programs.(CVE-2008-2807)

Masahiro Yamada discovered that Firefox did not properly sanitize file URLs in directory listings, resulting in files from directory listings being opened in unintended ways or not being able to be
opened by the browser at all. (CVE-2008-2808)

John G. Myers discovered a weakness in the trust model used by Firefox regarding alternate names on self-signed certificates. If a user were tricked into accepting a certificate containing alternate name entries, an attacker could impersonate another server. (CVE-2008-2809)

A flaw was discovered in the way Firefox opened URL files. If a user were tricked into opening a bookmark to a malicious web page, the page could potentially read from local files on the user's computer. (CVE-2008-2810)

A vulnerability was discovered in the block reflow code of Firefox. This vulnerability could be used by an attacker to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2811)

Firefox 3 World Record

FANS of the Mozilla Firefox web browser were attempting to set a world record for the most downloads of a software program in 24 hours. And guess what - we almost did it! It just took five hours to download over 1.6 million copies to get rid of old download record set by Firefox 2.

The offical body of Guinness World Records is yet to approve and announce the record attempt. However, you can go ahead and flaunt it by downloading and printing your very own personalized Firefox 3 Download Day certificate.

From the official blog:

We are currently serving almost 9,000 downloads a minute, which puts us on track to achieve 5-7 million downloads our first day of general availability. To put some more color behind what's been happening on this historic day:

  1. We exceeded the first day download mark for Firefox 2 of 1.6 million after just five hours of availability for Firefox 3.
  2. Net Applications is already reporting a 300% positive change in Firefox 3 market share worldwide just today.

Well done everyone and soon there will be a new World Record :D

Red hat issued update for NSPR and NSS packages that fix a bug and add an enhancement are now
available for download via RHN for RHEL 5.x systems.

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509

NSPR provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing and calendar time, basic
memory management (malloc and free) and shared library linking.

The program would hang when using the batch processing feature of the certutil tool. These packages fix this issue so that the program does not hang when using the batch processing feature of the certutil tool.

These updated packages provide base and cryptography services required by Mozilla Firefox 3.

How do I update my system?

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Simply login as root and type the following command:
# yum update
Sample output:

Loading "rhnplugin" plugin
Loading "security" plugin
rhel-x86_64-server-vt-5   100% |=========================| 1.2 kB    00:00
rhel-x86_64-server-5      100% |=========================| 1.2 kB    00:00
Skipping security plugin, no data
Setting up Update Process
Resolving Dependencies
Skipping security plugin, no data
--> Running transaction check
---> Package yelp.x86_64 0:2.16.0-19.el5 set to be updated
---> Package nspr.i386 0:4.7.1-1.el5 set to be updated
---> Package nspr.x86_64 0:4.7.1-1.el5 set to be updated
---> Package nss.i386 0:3.12.0.3-1.el5 set to be updated
---> Package nss-tools.x86_64 0:3.12.0.3-1.el5 set to be updated
---> Package nss.x86_64 0:3.12.0.3-1.el5 set to be updated
---> Package xulrunner.x86_64 0:1.9-1.el5 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
=============================================================================
 Package                 Arch       Version          Repository        Size
=============================================================================
Updating:
 nspr                    i386       4.7.1-1.el5      rhel-x86_64-server-5  119 k
 nspr                    x86_64     4.7.1-1.el5      rhel-x86_64-server-5  117 k
 nss                     i386       3.12.0.3-1.el5   rhel-x86_64-server-5  1.1 M
 nss                     x86_64     3.12.0.3-1.el5   rhel-x86_64-server-5  1.1 M
 nss-tools               x86_64     3.12.0.3-1.el5   rhel-x86_64-server-5  2.2 M
 xulrunner               x86_64     1.9-1.el5        rhel-x86_64-server-5   10 M
 yelp                    x86_64     2.16.0-19.el5    rhel-x86_64-server-5  583 k
Transaction Summary
=============================================================================
Install      0 Package(s)
Update       7 Package(s)
Remove       0 Package(s)
Total download size: 16 M
Is this ok [y/N]: y
Downloading Packages:
(1/7): xulrunner-1.9-1.el 100% |=========================|  10 MB    00:09
(2/7): nss-3.12.0.3-1.el5 100% |=========================| 1.1 MB    00:00
(3/7): nss-tools-3.12.0.3 100% |=========================| 2.2 MB    00:02
(4/7): nss-3.12.0.3-1.el5 100% |=========================| 1.1 MB    00:00
(5/7): nspr-4.7.1-1.el5.x 100% |=========================| 117 kB    00:00
(6/7): nspr-4.7.1-1.el5.i 100% |=========================| 119 kB    00:00
(7/7): yelp-2.16.0-19.el5 100% |=========================| 583 kB    00:00
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
  Updating  : nspr                         ####################### [ 1/14]
  Updating  : nss                          ####################### [ 2/14]
  Updating  : xulrunner                    ####################### [ 3/14]
  Updating  : nspr                         ####################### [ 4/14]
  Updating  : yelp                         ####################### [ 5/14]
  Updating  : nss-tools                    ####################### [ 6/14]
  Updating  : nss                          ####################### [ 7/14]
warning: /etc/pki/nssdb/cert8.db created as /etc/pki/nssdb/cert8.db.rpmnew
warning: /etc/pki/nssdb/key3.db created as /etc/pki/nssdb/key3.db.rpmnew
  Cleanup   : yelp                         ####################### [ 8/14]
  Cleanup   : nspr                         ####################### [ 9/14]
  Cleanup   : nspr                         ####################### [10/14]
  Cleanup   : nss                          ####################### [11/14]
  Cleanup   : nss-tools                    ####################### [12/14]
  Cleanup   : nss                          ####################### [13/14]
  Cleanup   : xulrunner                    ####################### [14/14]
Updated: nspr.i386 0:4.7.1-1.el5 nspr.x86_64 0:4.7.1-1.el5 nss.i386 0:3.12.0.3-1.el5 nss.x86_64 0:3.12.0.3-1.el5 nss-tools.x86_64 0:3.12.0.3-1.el5 xulrunner.x86_64 0:1.9-1.el5 yelp.x86_64 0:2.16.0-19.el5
Complete!

The addons has been downloaded several thousands of time over past 3 months. Mozilla warned that a malicious program inserted adware code into a Firefox plugin. According to Mozilla security chief Window Snyder:

Everyone who downloaded the most recent Vietnamese language pack since February 18, 2008 got an infected copy. Mozilla does virus scans at upload time but the virus scanner did not catch this issue until several months after the upload.

=> Virus found in Vietnamese language pack (Via Y! news)

Humor: Firefox Logo in Deep Space

I, for one, would like to welcome our new Mozilla Firefox overload directly from deep space ;)

V838 Monocerotis (V838 Mon) is a variable star in the constellation Monoceros about 20,000 light years from the Sun. The star experienced a major outburst in early 2002. Originally believed to be a typical nova eruption, it was then realized to be something completely different. The reason for the outburst is still uncertain, but several theories have been put forward, including an eruption related to stellar death processes and a merger of a binary star or planets.

On January 10, 2002, a previously unknown star was seen to brighten up in Monoceros, the Unicorn. Being a new variable star, it was designated V838 Monocerotis, the 838th variable star of Monoceros.


(Fig. 01: Monocerotis as Firefox logo (Image credit NASA and Wired blog)

=> Firefox Logo Spied In Deep Space (via digg)