Mozilla Fixes Critical Firefox Flaws

Mozilla released fixes for two critical security vulnerabilities Friday, which covered the way for hackers to begin malicious attacks that could crash a browser or take complete control of a user's computer.

The latest Firefox version 3.0.8, which initially was slated for release April 1, addresses critical errors affecting multiple versions of the Firefox 3 Web browser.

One of the critical Firefox updates repaired a critical flaw, made public during the renowned pwn2own contest at the CanSecWest 2009 hacker conference earlier in March that could allow hackers to launch a drive-by attack in the context of the browser.

The flaw was publicly demonstrated by a German hacker known only as Nils, 25, who successfully hacked the browser in exchange for a Sony Vaio machine running Windows 7.
The second critical bug, affecting Firefox version 3.0.7, stems from a XSLT vulnerability that resulted from improper handling of errors when transforming an XML document. The flaw, which was first brought to light by security researcher Guido Landi, could potentially be exploited by attackers who enticed unsuspecting users to open a malicious file using the affected Firefox browser. Once the victim viewed an infected file, attackers could then execute arbitrary code on the user's computer to crash the browser or initiate a denial of service attack.

While the execution of arbitrary code hasn't been proven in the XSLT flaw, it is also not entirely ruled out, Secunia researchers said in blog post.

Mozilla said in its advisory Thursday that it had been investigating both issues and was in the process of undergoing quality assurance testing for the impending fixes, implying that they would be forthcoming soon.

Security experts recommended that users update their browsers with the latest version of Firefox in order to protect vulnerable systems from attack. Additionally, Secunia researchers advised in a blog post that users avoid opening untrusted Web sites or clicking on unsolicited links, which might contain malware.

Some Related Search:
Browser Support Services
Firefox will not start after installing or updating McAfee SiteAdvisor
Outlook Live for IE, Firefox and Safari

Firefox will not start after installing or updating McAfee SiteAdvisor

Firefox may fail to open after:
* installing or updating the McAfee SiteAdvisor Firefox extension, or
* updating McAfee software that includes the SiteAdvisor component

According to MacAfee, the problem is caused by a conflict between SiteAdvisor and automatic proxy configuration scripts in Firefox. To fix this problem, you must start Firefox in Safe mode and uninstall the SiteAdvisor extension. This post describe how to troubleshoot this browser problems. Follow below given

1. Close down Firefox completely: At the top of the Firefox window, click the File menu, and select the Exit menu item.Close down Firefox completely: On the menu bar, click the Firefox menu, and select the Quit Firefox menu item.Close down Firefox completely: At the top of the Firefox window, click the File menu, and select the Quit menu item.
2. In Windows, click Start, open the All Programs list, and navigate to the Mozilla Firefox folder. In the Mozilla Firefox folder, select Mozilla Firefox (Safe Mode).
3, Mac OS:
Hold down the Option key, as you start Firefox.
2.0, Mac OS:
Go to the Utilities directory (in the Applications folder) and open Terminal, then run:

/Applications/Firefox.app/Contents/MacOS/firefox -safe-mode

Go to your Terminal and run:

/path/to/firefox/firefox -safe-mode

3. Firefox should start up with a Firefox Safe Mode dialog.

Note: You can also start Firefox in Safe Mode by clicking Start, selecting Run (or use the Start Search box in Windows Vista) and then entering the following in the text field:

--------------------firefox -safe-mode


4. When Firefox starts in Safe Mode, select the Tools menu at the top of the Firefox window, and select Add-ons. The Add-ons window opens.
5.In the Add-ons window, select the Extensions panel.
6. Select the SiteAdvisor extension.
7. Click Uninstall.
8. If SiteAdvisor is installed as part of a McAfee software package such as McAfee Internet Security Suite, you can selectively remove just the SiteAdvisor component using the McAfee uninstaller. For more information, see the documentation that came with the MacAfee product.