The open-source Mozilla Foundation has released a new
version of its Firefox browser which fixes two widely reported
critical security bugs.
The most well-publicised flaw concerns the IDN
(Internationalised Domain Name) feature in Firefox.
A bug allows web pages that use local character sets to be
hijacked as a vehicle for buffer overflow attacks on users,
enabling attackers to run malicious code on their machines.
The newly released Firefox 1.0.7 also addresses a problem in the
way the browser handles Unix and Linux shell commands, which could
allow attackers to run unauthorised malware on users’ machines.
Before the launch of Firefox 1.0.7, Mozilla had encouraged users
to turn off the IDN feature in Firefox as a workaround. With the
new release they can now safely handle IDNs.
