FireMozFeeds

As discussed for the past two weeks in our usual developer meetings, we’ve frozen the mozilla-central repository as of 23:59 PDT in order to prepare Firefox 3.1 Alpha 1 for delivery. The tree will be held frozen to allow several build cycles to run through our automatic tests, and the build team will begin the process of tagging and building tomorrow morning at 09:00 PDT. Once tagging is complete, the repository will re-open.

The first minor update to Mozilla Firefox 3 has been released. Firefox 3.0.1 fixes three critical security vulnerabilities, improves stability and resolves a handful of other small bugs.

The security fixes are detailed in the Firefox 3.0.1 section of the Security Advisories for Firefox 3.0 page. Two of the issues — one related to how Firefox handles command-line URLs to open multiple tabs and another allowing remote code execution by overflowing a CSS reference counter — were also present in Firefox 2 and fixed in Tuesday's Firefox 2.0.0.16 release. Security improvements in Firefox 3 mean that it's not vulnerable to some of the Firefox 2 variants of the command-line multiple tab exploit but it can still be compromised by combining the attack with a script injection flaw.

The final flaw only affects Mac OS X and allows an attacker to crash Firefox with a malformed GIF file, potentially gaining the ability to execute arbitrary code on the victim's computer. This vulnerability is not present in Firefox 2.

The non-security fixes include an issue where the phishing and malware database did not update on first launch and a problem that could cause Firefox to not save the security certificate exceptions list properly. A bug that could result in missing output when printing a selection from a page (bug 433373) was resolved and a Linux issue causing Firefox to always start in offline mode when using a PPP connection (bug 424626) was also fixed. The Public Suffix list has also been updated (bug 438585).

The Firefox 3.0.1 Release Notes have more details about the fixes in this minor upgrade. The new version can be downloaded from the Firefox product page or the Firefox 3.0.1 directory on releases.mozilla.org but most Firefox 3 users are expected to get it via the software update feature built in to the browser or their own operating system's update facility.

Talkback

Firefox is more than just a program it's a whole new world! and we need to show planet earth that's I.E. is not the internet it's just a program that can browse it, and that firefox is the only real way to enjoy the web!

Firefox is more than just a program it's a whole new world! and we need to show planet earth that IE is not the internet it's just a program that can browse it, and that firefox is the only real way to enjoy the web!

Mozilla Firefox 2.0.0.16 was released this week. The stability and security update to Firefox 2 fixes two security bugs, which are detailed in the Firefox 2.0.0.16 section of the Security Advisories for Firefox 2.0 page. Both are rated Critical, the highest of the four ratings.

One flaw is related to how Firefox handles command-line URLs to open multiple tabs and allows an attacker to open potentially malicious URLs in Firefox from another application. One variant of this attack exploits the widely-reported Safari carpet-bombing vulnerability but others also exist. Somewhat ironically, the exploit relies on Firefox not being open at the time of the attack.

The other vulnerability allows an attacker to crash and run arbitrary code on a victim's computer by overflowing a CSS object reference counter. The detailed bug reports for both issues are currently access-restricted to avoid assisting attackers but will be fully opened after users have had some time to install Firefox 2.0.0.16.

Although Firefox 3 was released in June and all users are encouraged to upgrade, Firefox 2 will be maintained with security and stability upgrades until mid-December 2008, according to the Mozilla Developer News weblog, which reported on the release of Firefox 2.0.0.16 on Tuesday. Version 2.0.0.16 is the second Firefox 2 update to be released since the launch of Firefox 3 and follows on from Firefox 2.0.0.15, which fixed twelve security issues.

Existing Firefox 2 users will be offered 2.0.0.16 via the browser's built-in software update feature if enabled. It can also be downloaded from the older Firefox releases page or the Firefox 2.0.0.16 directory on releases.mozilla.org, where it is available in over forty localizations for Windows, Mac OS X and Linux. The Firefox 2.0.0.16 Release Notes contain more general information about the upgrade.

Talkback

The official Mozilla Blog has confirmation that Mozilla Firefox 3 now holds the official Guinness World Record for the largest number of software downloads in twenty-four hours. On Download Day, there were 8,002,530 downloads of Firefox 3 between 6:16pm UTC/GMT on Tuesday 17th June 2008 and 6:16pm UTC/GMT on Wednesday 17th June 2008.

Gareth Deaves, Records Manager for Internet and Technology at Guinness World Records, presented the official Guinness World Record certificate to Mozilla Europe President Tristan Nitot at a ceremony in London on Wednesday 9th July. While this official certificate is held by Mozilla, anyone who contributed to the record attempt can download their own personalized Firefox 3 Download Day certificate from Spread Firefox.

In a weblog post, Gervase Markham explains that the actual Download Day figure should be 8,002,529, as a Guinness World Records representative downloaded Firefox 3 during the twenty-four period, which cannot count as he is an official. Meanwhile, Mary Colvig has posted some details about the behind-the-scenes efforts that went into organizing Download Day and Asa Dotzler has published responses to some criticisms of the Guinness World Record attempt.

Talkback

In der letzten Brauser-Statistik für Europa hatte Slowenien einen Firefox-Anteil von knapp 50% Österreich nichteinmal halb so viel und Deutschland immerhin 33%. Damit sind wir mal wieder in einer Statistik der Moderne unter den Schlusslichtern. Grund genug sich dafür zu engagieren?

read more

read more