Mozilla updates Firefox and Thunderbird to version 2.0.0.14

[Wiz Feinberg]

Mozilla Foundation has released Firefox and Thunderbird updates to version 2.0.0.14, on the morning of April 17, 2008, to fix a security vulnerability in the JavaScript engine. SeaMonkey was also updated to plug the same vulnerability.

MFSA 2008-20

Mozilla Foundation Security Advisory 2008-20

Title: Crash in JavaScript garbage collector
Impact: Critical
Announced: April 16, 2008
Products: Firefox, Thunderbird, SeaMonkey
Fixed in:
Firefox 2.0.0.14
Thunderbird 2.0.0.14
SeaMonkey 1.1.10

Description
Fixes for security problems in the JavaScript engine described in MFSA 2008-15 (CVE-2008-1237) introduced a stability problem, in Firefox 2.0.0.13, where some users experienced crashes during JavaScript garbage collection. This is being fixed primarily to address stability concerns. We have no demonstration that this particular crash is exploitable but are issuing this advisory because some crashes of this type have been shown to be exploitable in the past.

Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail.

Workaround

Disable JavaScript until a version containing these fixes can be installed.

Since this issue is still not fully resolved you can protect your computer from possible JavaScript exploitation by installing the "No Script" add-on. I use it all the time, for a safer browsing experience, whitelisting safe websites and leaving unknowns scriptless. It is easy to allow any blocked scripts, with a mouse click on the No Script icon, in the Firefox Status bar. In addition to JavaScript, No Script also by default blocks Flash, Java, Silverlight and Cross Site Scripting. Read the details before installing No Script.

As usual, if you have set your Firefox, Thunderbird or SeaMonkey preferences to automatically chack for updates you will receive this update today. Otherwise, in Firefox, click on Help > Check for Updates. You can also download the latest version of Firefox here, manually.

[Bent Romnes]

Wiz,
Firefox is a great browser and I have it set for automatic updates.

It is the first time I heard about Seamonkey when you mentioned it in this thread. I went and read briefly about it on the sm-project site. I understand it to be a browser, email client, IRC chat client and web page building program all wrapped into one. This puts me in mind of the now defunct Netscape which was my favorite. I never did use IE much.

I would like to hear your personal take on Seamonkey; your experiences and recommendations. Or, for one like me who primarily browses and uses Eudora for email, would there be much sense for me to get Seamonkey?
Thanks
Bent

[Wiz Feinberg]

Alas, I know nothing about SeaMonkey, other than what you have stated. I choose to assemble my various online components ala-carte. To me it sounds like it resembles the old Netscape Communicator Suite, of the late 1990's, but with modern components. We wouldn't mind hearing comments about it from any SeaMonkey users among our members.