Mozilla Firefox 1.5.0.2

By Copernic
in Back Page News

 Share

Recommended Posts

Mentor

Raven

Posted
Posted

This was great. I got a message box informing me of the already installed update and to restart Firefox. These guy (and gals) have come a long way to make the best browser on the market (IMHO). MS might as well buy Mozilla 'cause that's the only way they'll have a decent browser.

Grand Master

Farstrider

Posted
Posted

Firefox 1.5.0.2 Fixes 21 Vulnerabilities

The Mozilla Foundation released an update to fix 21 security vulnerabilities in their Web browser, Firefox 1.5 for Windows, Linux, and Mac. If one of your users visits a malicious Web page, an attacker could exploit the worst of these vulnerabilities to execute code on that user's computer, with that user's privileges, possibly gaining complete control of the computer. If you use Firefox on any platform, you should download and deploy version 1.5.0.2 as soon as possible.

The Mozilla Foundation released Firefox 1.5.0.2, fixing 21 security vulnerabilities, as well as a few other stability issues, in the popular Web browser. Many of these vulnerabilities could allow a remote attacker to execute arbitrary code on your users' computers. We highlight three of the more worrisome flaws below:

An integer overflow in CSS Letter-Spacing. Firefox's CSS Letter-Spacing property suffers from an integer overflow vulnerability. By enticing one of your users to a malicious Web page, an attacker could exploit one of these integer overflows to execute code on that user's computer with the user's privileges. If you give your users local administrative privileges, an attacker could potentially exploit this flaw to gain control of their system.

Code execution vulnerability in particular JavaScript method. A flaw in a particular JavaScript method (called crypto.generateCRMFRequest) allows remote attackers to execute code on one of your user's machines with that user's privileges. However, like the flaw above, the attacker would first have to entice his victim to a malicious Web page for this attack to succeed.

Flaws in DHTML handling may allow code execution. Firefox suffers from several security vulnerabilities and crash bugs involving the way it handles DHTML Web content. Some of these vulnerabilities could allow attackers to execute code on your users' computers with their privileges. Like both flaws above, the hacker would have to entice your users to a malicious Web page in order to exploit these flaws.

These three flaws alone should convince you to update your Firefox users as soon as possible. However, if you'd like to know more about the remaining vulnerabilities, check out Firefox's known issues page.

Mozilla has updated Firefox to version 1.5.0.2 in order to correct these security vulnerabilities. If you use Firefox in your network, download and deploy version 1.5.02 as soon as possible.

Windows

Mac OS X

These attacks arrive as normal-looking HTTP traffic, which you need to allow through your firewall so your end users can access the World Wide Web. Therefore, the patches above are your best solution.

Thought that this may help anyone looking for help or downloads!

Rookie

Jzilla

Posted
Posted

Firefox 1.5.0.2 Fixes 21 Vulnerabilities

It is Firefox 1.0.8 that has 21 or rather 18 Vulnerabilities fixed, NOT Firefox 1.5.0.2 as it only actually has 7 vulnerabilities fixed. http://www.mozilla.org/projects/security/k...rabilities.html

https://www.neowin.net/index.php?act=view&id=32838&cid=451400

Most of those advisories don't affect 1.5.0.1. The ones at the start say they affect Firefox before 1.5.0.2; the rest say they affect Firefox before 1.5 when in fact only 7 fixes are featured in 1.5.0.2 compared to a whopping 18 in 1.0.8.

By the way for Firefox 1.0.8 unlike what they planned in the past they decided that 1.0.8 will be the last of the old Aviary1.0.1 Branch releases unless something comes up to warrant a 1.0.9

Neowinian

RabbiDreed

Posted
Posted

Glad to say that it does fix a few of them.

  • Memory leaks
    • 321283 - Using Find causes documents to leak.
    • 323532 - Leak when using history autocomplete.
    • 323377 - Lots of leaks in nsInternetSearchService.

Yet it may have introduced a whole new BIGGER memory leak...

I've had to regress to 1.5.0.1 to avoid it crashing. The memory footpront is usually between 100MB and 250MB even with just 1 tab open! When it happens I can't even kill the process! I can't even shut down! Has to be a hard power off...

Just compliling some more evidence on another machine to submit a bug.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Ladybird Browser is no longer accepting outside contributions thanks to AI

      By David Uzondu · Posted

      Ladybird Browser is no longer accepting outside contributions thanks to AI by David Uzondu The Ladybird Browser Project has announced it will no longer accept public pull requests and will limit changes to those made by its maintainers as it works towards its first alpha release. According to Ladybird's creator Andreas Kling, this is "not a change we make lightly," but the rapid shift in AI capabilities forced their hand. Previously, a massive PR implied that the person behind it put a lot of care into the code and is ready to "answer for the consequences." Now with AI, anyone can generate a PR without even understanding the bug fix or feature they want merged. The blog post goes on to say that the team is closing all open public pull requests immediately, and that maintainers will not treat external forks as a review queue for upstream Ladybird. Instead, the team wants outside contributors to focus on reporting bugs and running tests. Kling started Ladybird back in 2019 as LibHTML, a simple HTML viewer for his hobby operating system, SerenityOS, but by September 2022, it had turned into a full-fledged browser project. What sets Ladybird apart from the likes of Google Chrome, Apple Safari, or Mozilla Firefox is its totally independent engine, which does not rely on pre-existing codebases. The project maintains a strict policy against default search engine deals or user data monetization, keeping development funded entirely by donations and sponsorships. Generative AI is forcing open source project maintainers to rethink how they handle public code contributions (and the whole open-source thing in general). One month ago, a leak about the National Health Service (NHS) suggested the organization was planning to take all of its public repositories private ahead of a May 11 deadline, thanks to Mythos (an AI model that Anthropic believes is too dangerous to be released to the public) and its ability to find and write exploits for zero-day vulnerabilities. Thankfully, the Government Digital Service (GDS) issued a counter-report titled "AI, open code and vulnerability risk in the public sector" that stopped the shutdown by pointing out that hiding code does not improve security.
    • Kalmuri 4.2.4

      By Copernic · Posted

      Kalmuri 4.2.4 by Razvan Serea Kalmuri is your all-in-one, portable screen capture and recording solution designed for speed, simplicity, and flexibility. Whether you need a full-screen snapshot, a custom area, a scrolling webpage, or smooth video recording, Kalmuri delivers with ease. Capture text instantly from images with built-in OCR, keep floating images on top for quick reference, and use the precise color picker for perfect design matching. Customize hotkeys to work your way and share results instantly with built-in upload options. Kalmuri runs without installation, making it ideal for USB use, and offers an intuitive interface that’s easy to learn. Kalmuri key features: Video recording support (designation of whole screen and area) Whole screen, active program, window control, area application Extract text from images using optical character recognition (OCR). Support for PNG, JPG, WEBP, BMP, GIF file formats MP4 video recording powered by FFmpeg for high-quality results Full web page capture Share the captured image on the web Color extraction function Printer output Hotkey settings Adjustable via keyboard for area capture (Arrow key, Ctrl+Arrow key, Shift+Arrow key) File name format (sequential, datetime) Free to use it at work, at home, in government offices, at school, etc. Using Kalmuri portable for video recording Kalmuri’s portable version doesn’t include FFmpeg, which is required for video recording. Without it, you’ll get an “error FFmpeg.exe not found” message. To fix this, download FFmpeg from the provided link, extract it, and place FFmpeg.exe in Kalmuri’s folder. Kalmuri will then recognize it automatically, allowing you to start recording in high quality instantly. Kalmuri 4.2.4 changelog: Fixed an issue where color picking could occasionally freeze Improved capture stability Resolved a possible unexpected app shutdown in certain cases Refined internal handling for a smoother experience Download: Kalmuri 4.2.4 | 24.2 MB (Freeware) Download: Kalmuri Portable 4.2.4 | 2.1 MB View: Kalmuri Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Microsoft is making Windows 11's context menus faster, simpler, and configurable

      By duhk · Posted

      I like the show more options. The only problem with it is that it's not always in a consistent spot in the menu. If the copy/paste/cut, happens to show on top, then more option is the last in the menu. But if copy/paste/cut happens to show on the bottom, then more options is before the copy/paste/cut. But I do like the more options because it hides the stuff that I rarely use. But I would like to choose what it is or isn't hiding. That would make it better.
    • Microsoft is making Windows 11's context menus faster, simpler, and configurable

      By Michael Scrip · Posted

      I wonder if "put it back the way it was for decades" ever crossed their minds? 🤣
    • Microsoft is making Windows 11's context menus faster, simpler, and configurable

      By PsYcHoKiLLa · Posted

      Rescind the stupid "Show more options" in context menus and just give us the full menu instead of adding more steps to get to what we want. The "simpler by default" makes me think they'll go in the opposite direction. Every context menu should have a configure button so you can pick and choose what options should be shown, I know you can do that with some registry fu but that shouldn't be required.

  • Recent Achievements

    • Week One Done
      I2D earned a badge
      Week One Done
    • Week One Done
      Dr Jared Dental Studio earned a badge
      Week One Done
    • Week One Done
      RG INVESTMENT GROUP earned a badge
      Week One Done
    • Very Popular
      The Norwegian Drone Pilot earned a badge
      Very Popular
    • Very Popular
      s0nic69 earned a badge
      Very Popular

  • Popular Contributors

    1. 1
      +primortal
      476
    2. 2
      PsYcHoKiLLa
      253
    3. 3
      Skyfrog
      81
    4. 4
      FloatingFatMan
      64
    5. 5
      Michael Scrip
      62
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!