[Steve]

Mozilla plans to release a security update for its Firefox browser next week which will repair a long-standing security flaw in the software. This will take Firefox to version 2.0.0.10. The update is being tested now and should be released to the public next week.

The issue was first reported last February, but it gained widespread attention earlier this month when researcher Petko Petkov pointed out on his blog that the flaw could be used to launch a cross-site scripting attack against the Firefox browser. The flaw has to do with the fact that Firefox does not properly check files that are compressed using the .jar
(Java Archive) format. Attackers could sneak malicious code into the Jar-compressed documents, which would then be run by the victim. This attack could be launched against Google users, giving them access to victims' Gmail accounts, Google searches and other sensitive data stored on the Google Web site.

All recent versions of Firefox 2.0.0.x will detect the availability of the update when it is released and offer to install it automatically.

[Steve]

As expected, Mozilla has just released version 2.0.0.10 of the 'Firefox' web browser; this version fixes a security issue, and you should download and install it immediately.

Firefox may have already done this for you, but you can double-check by launching the program and using the command [Help][Check for Updates].

Provided your version is recent, this should detect and offer to install the patch. If you have an old version (and if you do, you should reinatall it now as old versions are insecure) you may not be offered this. You can check your version using the command [Help][About Mozilla Firefox].

The update patches six vulnerabilities in Firefox, including a flaw that has been known about but not fixed for most of this year. Firefox 2.0.0.10 is the ninth security update to the browser this year and has patched two bugs associated with the jar: uniform resource identifier (URI) protocol handler. The original flaw was reported in early February, but the fix was not developed until three weeks ago, when a U.K. researcher reported that applications that allow uploading of jar or Zip files are vulnerable to cross-site scripting attacks. Cross-site scripting vulnerabilities are most often used by identity thieves and malware authors to steal passwords or spread malicious code.

Firefox 2.0.0.10 has also fixed a flaw that could be used to launch cross-site request forgery (CSRF) attacks, which inject malicious commands into legitimate Web sites.

[WOODY]

THANKS FOR THE INFO STEVE, I USE FIREFOX, I HAVE JUST UPDATED TO THE
LATEST VERSION. THANKS

[Angela]

I've also just updated to the latest version and now FF will not connect to the internet. I can get in fine with IE so not entirely sure what's going on. Any suggestions?

[Markulous]

Originally Posted by Angela

I've also just updated to the latest version and now FF will not connect to the internet. I can get in fine with IE so not entirely sure what's going on. Any suggestions?

Firewall shutting it out?

Mine updated itself around the time Steve suggested it would do so!
And works!

[Angela]

Yep firewall. I've just sorted it! I had to delete the manual controls and re-add them to the list. All seems to be fine now.