Forum Moderators: open
Firefox 1.5.0.7 is a security and stability update that is part of our ongoing program to provide a safe Internet experience for our customers. We recommend that all users upgrade to this latest version.
- Improvements to product stability
- Several security fixes
Release Date: September 14, 2006
Several security fixes [mozilla.org]
..Seriously, though... with Microsoft's absolutely abysmal security record... why on earth would you want to use yet another version of their browser that lets any website install any software it wants to on your computer?...
I thought this comment deserved an update:
From headlines the past couple of days:
Firefox JavaScript security "a complete mess" ...
..But Firefox is also fairly insecure,"...
...The hackers claim they know of about 30 unpatched Firefox flaws..
...Symantec's biannual Internet Security Threat Report, the last six months saw a significant uptick in the number of security vulnerabilities found in web browsers. Leading the way was Firefox, with 47 bugs discovered. Researchers and hackers discovered 38 vulnerabilities in Internet Explorer, 12 in Safari, and seven in Opera....
Just as important, it is eight years behind web standards.
IE has hundreds more vulnerabilities than any other browser.
Not hardly. I don't know where this figure "hundreds" keep coming up, but it is more like 30-50, with maybe 1-2 being serious ATM.
That old mantra has been around for so long, that some actually believe it.
In reality it has LESS than most other browsers - but because it is by far the most common one, it is also the one most commonly attacked. You don't see Norway attacked by Al Qaeda, and you don't see Opera attacked by the hackers.
And while the Symantec report is only partly correct, there are many other reports about Firefox totally independent of Norton that indicate that it has quite a few flaws and vulnerabilities. None seem especially serious, but it certainly belies the old adage of FF being hack and bug free.
Just as important, it is eight years behind web standards
Hmm.. 2003 --> 2006 = 8 years?
[edited by: Wlauzon at 2:38 am (utc) on Oct. 4, 2006]
While IE6 has been around since only 2001, it does not meet standards of the DOM set in 1998, nor CSS1, and even a couple of HTML elements. IE7 won't either so, when it comes out, it will be nine years behind. ALL other browsers cover these areas quite well.
I thought this comment deserved an update:
Hehe... nice try. The recent "zero day exploit" for Firefox was a hoax... again. Oh, but there was yet another zero-day Internet Explorer exploit that Microsoft took a couple weeks to patch. Hundreds of thousands affected there again.
And all the "bugs" people write about in Firefox are based on the Bugzilla database... which lists feature requests, etc. Basically all kinds of things that aren't actually bugs. A commercial product like IE only counts bugs as those it acknowledges as a bug and fixes with a released update and announcement. We don't get to see Microsoft's actual bug tracker.
And on unpatched public vulnerabilities (stuff that's known about and can be actively exploited)... let's compare...
Internet Explorer 6.x:
[secunia.com...]
"The most severe unpatched Secunia advisory affecting Microsoft Internet Explorer 6.x, with all vendor patches applied, is rated Extremely critical" (19 of 106 unpatched)
Mozilla Firefox 1.x:
[secunia.com...]
"The most severe unpatched Secunia advisory affecting Mozilla Firefox 1.x, with all vendor patches applied, is rated Less critical" (3 of 36 unpatched)
And, for a complete overview, more-recent Opera releases don't have any know issues in the Secunia database (Opera 5 and 6 do, but I think they're patched in the 7 and up releases... and no one should be using 5 or 6 at this point)
No browser is perfect. No browser will be 100% secure. No browser will never need a patch. But I stand by my classification of IE's security record as "abysmal". No other browser has allowed so many crackers to automatically install so many malicious software bits... and we're talking automatic here... nothing required of the user other than clicking a link or mistyping google.com in their address bar.