Mozilla releases Firefox security update

Released Wednesday, Mozilla Firefox 1.0.4 provides several security fixes, including ones for the vulnerabilties that cropped up early in the week. Those flaws, rated as critical, would allow an attacker to take advantage of the open-source browser's software update system to run arbitrary code.

The update protects users who have added non-Mozilla sites to their software installation white lists, said Chris Hofman, director of engineering at Mozilla.

Mozilla was unaware of any actual exploits of the vulnerabilities, he said. The foundation works actively to ensure Firefox's security, he added.

"We continue to do research and engage both volunteers and commercial companies to help us in evaluating the browser and looking at it from a number of perspectives to help us find vulnerabilities or potential vulnerabilities, and we work actively to get those fixed as quickly as possible," Hofman said.

Firefox 1.0.4 is available in 12 languages out of the 37 it is shipped in, he said. Plans call for releasing the rest of the language versions in the next couple of days.

www.mozilla.org