Critical Flaws found in Firefox & Thunderbird


Recommended Posts

The Mozilla Project has issued a warning for a series of "highly critical" security holes in three of its core projects, including its flagship Firefox Web browser and the Thunderbird e-mail client.

See this article for details:

http://www.internetnews.com/dev-news/article.php/3408301

I noticed that.... :unsure:

If the bugs reported in the article above are relating to the announcement on Mozilla.org's security page, in this press release, then any current PreRelease download should have it. Although it is not very clear. I would think that they would make it 1.0aPR or 1.0-1PR or some other designation to show that is includes the fixes which are apparently already released.

Anyone else have insight into this?

An advisory released by Secunia warned that the flaws carry a "highly critical" rating and affects all versions of the software prior to Mozilla 1.7.3, Firefox 1.0PR and Thunderbird 0.8.

That means that current versions of the software are clean. Or at least that's what it looks like to me

I found out more on this...

The bug fixes accompany the release of the Firefox 1.0 preview release (PR), a nearly-finished version of the project's next-generation browser.
http://www.infoworld.com/article/04/09/15/...llaflaws_1.html

and

The holes affect versions prior to Mozilla 1.7.3, Firefox 1.0PR, and Thunderbird 0.8.
http://www.theinquirer.net/?article=18460

So, it seems that .9x is safe, as is 1.0PR

Looks like the first article was a bit sensationalist. These were likely bugs in their daily builds, but not in the released versions....

I am still using 0.9.3 - should I now get the latest 1.0PR or is there a 0.9.4 out with this patch?  I couldn't see any advice on the mozilla.org site

Yeah im wondering the same! :blink:

Edit: Yeh sorry I cant read silly me :angry:

Thanks for the info mark.

For those of you running Firefox ...

Check out the WinTel optimized builds for specific CPU instruction sets...

http://www.moox.ws/tech/mozilla/

They are TREMENDOUSLY faster than the builds released by Mozilla

Per Moox's website:

Optimized Firefox & Thunderbird Builds

I build optimized builds of both the Firefox browser and the Thunderbird email client. My builds are designed for maximum speed and stability and I use both the BRANCH/AVIARY and TRUNK source trees. For the uninitiated, BRANCH builds are more stable than TRUNK builds, which are made from the absolute bleeding edge of the source code. For a complete description of the differences, please see this thread at Mozillazine. I also make milestone and release builds, as well as custom builds upon email request. Occasionally I will also do Firefox builds with SVG enabled. Additional information on SVG can be found at Mozilla and Croczilla.

I am currently releaseing three versions, or "M" builds - M1, M2, and M3. Each M version is designed for compatibility wirh particular processors and/or instruction sets.

Official thread on mozillaZine:

http://forums.mozillazine.org/viewtopic.php?t=75503

:yes:

For those of you running Firefox ...

Check out the WinTel optimized builds for specific CPU instruction sets...

http://www.moox.ws/tech/mozilla/

They are TREMENDOUSLY faster than the builds released by Mozilla

Yep, or better still use bangbang's one.

https://www.neowin.net/forum/index.php?showtopic=191297

You will need a processor that supports SSE2 though.

On topic: It seems like they announced the bug after it had been fixed. If this is so, I think that's a very good idea.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • OpenAI is rolling out a major upgrade to ChatGPT memory by Pradeep Viswanathan OpenAI is rolling out a major upgrade to ChatGPT's memory, making the system more capable, current, and scalable across long-term use. Memory allows ChatGPT to remember useful details about users, including their preferences, projects, and constraints. Instead of starting every conversation from scratch, ChatGPT can use this context to provide more relevant responses in future chats. OpenAI first launched saved memories in February 2024. That feature allowed users to explicitly ask ChatGPT to save information into its memory, such as travel plans or writing preferences. However, this system had limits because it depended heavily on users giving clear instructions to remember something. Additionally, saved memories could become stale over time. In April 2025, OpenAI expanded memory by allowing ChatGPT to reference past chat context outside the saved memories list. This was powered by a background process called “dreaming,” which automatically curates memories from chat history. This made ChatGPT better at learning from natural conversation without requiring users to manually save every detail. Today, OpenAI announced a more capable and compute-efficient memory architecture built on top of dreaming. This new system improves ChatGPT’s ability to carry forward useful context, follow user preferences, and remain accurate as time passes. According to OpenAI’s internal evaluations, the new system improves factual recall from 67.9% in 2025 to 82.8% in 2026. Preference adherence improves from 55.3% to 71.3%, while accuracy over time improves from 52.2% to 75.1%. The best part of this new system is a new memory summary page where users can review ChatGPT's memories. Users can even update details, correct information, or give instructions on what topics ChatGPT should bring up and when. This new, improved memory system is available to ChatGPT Plus and Pro users in the US starting today. It will roll out to more countries, as well as Free and Go users, in the coming weeks.
    • I work for a video production company in Australia. The camera operators shoot footage and then pass the SD card over to the editors. Much easier than handing over the entire camera. Plus, on a busy day you can hand off the SD card and then pop another in for the next shoot. Or, you might have used multiple SD cards because you need the extra space for a long shoot. I also use USB cables and wifi for transferring footage, but in many cases an SD card reader is the easiest method.
    • Microsoft Edge 149.0.4022.52 by Razvan Serea Microsoft Edge is a super fast and secure web browser from Microsoft. It works on almost any device, including PCs, iPhones and Androids. It keeps you safe online, protects your privacy, and lets you browse the web quickly. You can even use it on all your devices and keep your browsing history and favorites synced up. Built on the same technology as Chrome, Microsoft Edge has additional built-in features like Startup boost and Sleeping tabs, which boost your browsing experience with world class performance and speed that are optimized to work best with Windows. Microsoft Edge security and privacy features such as Microsoft Defender SmartScreen, Password Monitor, InPrivate search, and Kids Mode help keep you and your loved ones protected and secure online. Microsoft Edge has features to keep both you and your family protected. Enable content filters and access activity reports with your Microsoft Family Safety account and experience a kid-friendly web with Kids Mode. The new Microsoft Edge is now compatible with your favorite extensions, so it’s easy to personalize your browsing experience. Microsoft Edge 149.0.4022.52 changelog: Migration to improved V2 architecture for Workspaces. Workspaces, introduced in Edge in 2022, allows users to create durable sets of tabs that can be saved and shared with others. In order to improve reliability and performance of this feature, the following changes are being made: Migrating data for saved Workspaces from OneDrive/SharePoint to Edge Sync service Removing the collaboration/share functionality of this feature For organizations who have disabled Sync through policy, the existing v1 Workspace data will still be migrated to the new architecture. New v2 Workspaces created after migration won't sync across devices and will remain local to each device. This update occurs on a progressive rollout beginning in Edge Stable v145 and will continue rolling out in Edge v149. For more information, see Getting started with Microsoft Edge Workspaces. Feature Updates Passkey Sync for Enterprise Users. Microsoft Edge is introducing support for passkey synchronization for enterprise users, enabling secure, passwordless authentication across devices. Passkeys created in Edge can now be synced seamlessly, improving sign-in experience while maintaining strong security standards. Note: This is a controlled feature rollout. If you don't see this change, check back as we continue the rollout. Enterprise WebView2 runtime downgrade via DowngradeVersion policy. Administrators can temporarily roll back specific applications to a previous WebView2 Evergreen Runtime version (N-1 or N-2) using the new DowngradeVersion policy in msedgewebview2.admx. The Downgrade Version policy allows enterprises to mitigate critical regressions by specifying per-application exe-to-version mappings. The Edge Updater installs the target version side-by-side, and the WebView2 Loader redirects targeted apps accordingly. Downgrades auto-expire with each new WebView2 release: apps pinned to N-1 remain on the same version (now becoming N-2) and will auto-update in the next release, while apps pinned to N-2 will revert to the current Evergreen version. The policy applies only to enterprise-managed devices (domain-joined or MDM-enrolled). For more information, see Microsoft Edge WebView2 Policy Documentation | Microsoft Learn. Collections retirement. Collections has been removed in this update. Users can no longer access or use the feature. To keep saved content, users can export it, or move all pages to Favorites before updating to Microsoft Edge Stable 149. For more information, see Organize your ideas with Collections in Microsoft Edge - Microsoft Support. Modern, unified, and updated Look and Feel. Microsoft Edge has updated the Look and Feel to give customers a unified experience across all of Microsoft AI surfaces including Copilot and Bing. This changes multiple elements of the UX such as spacing, corners, fonts, default colors, etc. Clarify choices surrounding third-party cookie settings. Language under Settings > Privacy, search, and services > Cookies are clarified to better describe the choices users have in managing third-party cookies. Custom primary password retirement. Users are no longer able to create a new custom primary password in Edge Settings edge://settings/autofill/passwords/settings. Any users who are still using a custom primary password will be automatically migrated to device authentication. Additionally, the PrimaryPasswordSetting policy will no longer support the WithCustomPrimaryPassword option. For more information, see Keep your saved passwords private in Microsoft Edge | Microsoft Support. Unifying Copilot Chat policy controls. The Microsoft365CopilotChatIconEnabled policy is the standard for configuring Copilot Chat. Previously, this behavior was controlled by blocking the Copilot extension, either explicitly or by using the * wildcard via the ExtensionSettings or ExtensionInstallBlockList policies. Extension and sidebar policies no longer affect the appearance or functionality of Copilot Chat. Copilot address bar suggestions were also tied to extension policy settings. Starting in Microsoft Edge version 149, admins can use the CopilotAddressBarSuggestionsEnabled policy to manage this behavior. Intune MAM Protected Downloads. The protected downloads feature for Intune MAM is now available for BYOD (Bring Your Own Device) devices, which aren't managed by a tenant. Policy Updates / New policies CopilotAddressBarSuggestionsEnabled - Enable Copilot address bar suggestions CpuPerformanceTierOverride - Override for the CPU performance tier DataUrlInWebWorkerOpaqueOriginEnabled - Enable opaque origins for data URLs in Web Workers DefaultLocalFontsSetting - Default Local Fonts permission setting ForceForegroundPriorityForUrls - Force foreground priority for specific URLs LocalFontsAllowedForUrls - Allow Local Fonts permission on these sites LocalFontsBlockedForUrls - Block Local Fonts permission on these sites Deprecated policies WalletDonationEnabled - Wallet Donation Enabled (deprecated) EdgeWalletEtreeEnabled - Edge Wallet E-Tree Enabled (deprecated) Additional policy changes ForceForegroundPriorityForUrls - ForceForegroundPriorityForOrigins is renamed to ForceForegroundPriorityForUrls OnSecurityEventEnterpriseConnector - Add macOS platform support ProtectedContentIdentifiersAllowed - Remove macOS platform support Download: Microsoft Edge (64-bit) | 193.0 MB (Freeware) Download: Microsoft Edge (32-bit) | 170.0 MB Download: Microsoft Edge (ARM64) | 188.0 MB View: Microsoft Edge Website | Release History Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • User: "But is it good?" Microsoft: "Well, no. But it is less bad."
  • Recent Achievements

    • Week One Done
      Dr Jared Dental Studio earned a badge
      Week One Done
    • Week One Done
      RG INVESTMENT GROUP earned a badge
      Week One Done
    • Very Popular
      The Norwegian Drone Pilot earned a badge
      Very Popular
    • Very Popular
      s0nic69 earned a badge
      Very Popular
    • Collaborator
      Asgardi earned a badge
      Collaborator
  • Popular Contributors

    1. 1
      +primortal
      471
    2. 2
      PsYcHoKiLLa
      247
    3. 3
      Skyfrog
      80
    4. 4
      FloatingFatMan
      67
    5. 5
      Michael Scrip
      60
  • Tell a friend

    Love Neowin? Tell a friend!