*sigh* Even Firefox isn't 100% safe under Windows

[ciphergoth]

If you are running Firefox, Thunderbird or Mozilla under Windows, you need this patch right away or you will still be vulnerable to remote exploit. Users of other operating systems are not affected; the vulnerability is in Windows, but Firefox has been patched to work around it.

If you have just gone through the inconvenience of installing Firefox because of the vulnerability in IE, my heart goes out to you. I hope you'll take comfort in the fact that a fix for this problem is already available in Firefox and Mozilla (within a day of the exploit being published), while it seems there is still no effective fix for the problem in IE, so you still made the right choice.

Comments

Help!

[purplerabbits.livejournal.com]

I've patched Firefox, but can't work out how to do Thunderbird because the extension item isn't in the tools menue like they tell me it should be...

[wechsler.livejournal.com]

Hey, I had to click THREE TIMES to install that patch! I want a refund! ;)

Ignoring, of course, the fact that I had to manually reconfigure windows update and install a 100-MB Service Pack to 'fix' it in IE, and could only do so for IEv6 on the XP box.

[lilitufire.livejournal.com]

Thanks for pointing this out - Firefox goes like the clappers anyway, so I was still impressed with it :)

[ruis.livejournal.com]

As soon as other browsers get a bigger market share more people will bother trying to exploit them.

[keirf.livejournal.com]

Well, I'm quite glad I've switched to FireFox - it seems to run faster, and the middle-click to open a link in a new tab is excellent. They also did a really good job with the import favorites section of the install.

mayeb this'll make some people feel better *grin*

[bondagewoodelf.livejournal.com]

It appears this is not really a coding bug in the Mozilla software. Rather, they forgot to block a feature of Windows that can use the shell: handler. Actually, Firefox (and friends) try to be nice a offer all external protocol handlers registered to Windows (such as eg. aim:). Apparently windows itself offers something called shell: that can be use to fire commands and the Mozilla coders forgot to block the access from the browser to it.

[wildeabandon.livejournal.com]

Thanks for the heads up.

[countess-sophia.livejournal.com]

Thanks for the reminder about this. Duly done.

Soph x

[pavlos.livejournal.com]

I continue to laugh at the misfortunes of Windows users, but not too loudly in case someone decides to connect my mac forcibly with my head ;-)