The open-source Mozilla Foundation has released a new version of its Firefox browser which fixes two widely reported...
critical security bugs.
The most well-publicised flaw concerns the IDN (Internationalised Domain Name) feature in Firefox.
A bug allows web pages that use local character sets to be hijacked as a vehicle for buffer overflow attacks on users, enabling attackers to run malicious code on their machines.
The newly released Firefox 1.0.7 also addresses a problem in the way the browser handles Unix and Linux shell commands, which could allow attackers to run unauthorised malware on users’ machines.
Before the launch of Firefox 1.0.7, Mozilla had encouraged users to turn off the IDN feature in Firefox as a workaround. With the new release they can now safely handle IDNs.