• On The Insider: Miley Cyrus in Sex and the City 2
October 28, 2009 9:06 AM PDT

Firefox 3.5.4 closes security holes

by Stephen Shankland
  • Font size
  • Print
  • 46 comments
Share

Mozilla released Firefox 3.5.4 for Windows, Mac, and Linux on Tuesday to patch six critical security holes and some other problems.

The new browser version also improves stability and fixes a problem with clearing browser history, according to the release notes. Mozilla updated the corresponding version of its earlier browser to fix some of the same security problems by issuing Firefox 3.0.15.

The six vulnerabilities potentially could let remote attackers take over the computer by running their own software on the machine. For details, check the Firefox security site.

Meanwhile, Mozilla is on the brink of releasing the first beta of Firefox 3.6, a version that will add the Personas feature for a customizable look. Mozilla, trying to move to a faster Firefox release cycle, is debating whether to issue 3.6 as a minor release that arrives automatically or a major release that people must actively download.

Also Tuesday, Mozilla released SeaMonkey 2.0, which combines the Firefox browser and Thunderbird e-mail software into an all-in-one package. It uses Firefox 3.5.4.

Stephen Shankland writes about a wide range of technology and products, but has a particular focus on browsers and digital photography. He joined CNET News in 1998 and since then also has covered Google, Yahoo, servers, supercomputing, Linux and open-source software, and science. E-mail Stephen, or follow him on Twitter at http://www.twitter.com/stshank.
Recent posts from Deep Tech
Google acquires EtherPad online collaboration tool
Google edges toward Rosetta Stone status
Google wants to unclog Net's DNS plumbing
Phone photo quality interests Google, Microsoft
Intel hopes 48-core chip will solve new challenges
With an eye to the future, try raw photos today
No shocker: Google prefers HTML5 to Gears
Microsoft actively urges IE 6 users to upgrade
Add a Comment (Log in or register) (46 Comments)
  • prev
  • 1
  • next
by blariz October 28, 2009 9:24 AM PDT
The article states that 3.0.14 is the latest update of 3.0.xx. Actually 3.0.15 is the corresponding update to 3.5.4.
Reply to this comment
by Shankland October 28, 2009 11:27 AM PDT
Thanks, fixed that!
by cuz84d October 28, 2009 2:41 PM PDT
Both patched similar holes in the program at the same interval.

The upgrade path:

FF 3.0.14 -> FF 3.0.15.
FF 3.5.3 -> 3.5.4
by elrond_15800 November 1, 2009 7:23 PM PST
the home page short description still says 3.014
by rmva October 28, 2009 9:49 AM PDT
Is Firefox ever going to fix the bug that causes Check for Updates to be grayed out unless you Run As Administrator. The number of users who think they are current because they never get update notices must be phenominal.
Reply to this comment
by shellcodes_coder October 28, 2009 10:08 AM PDT
that's not a bug
by SergeM256 October 28, 2009 11:04 AM PDT
It is a bug. OK, it is not a bug in a sense that somebody who is totally clueless intentionally made it this way. Proper design would be to allow this option to any user and Windows would request admin password when installing update, that's how most applications handle updates.
by firefoxluva95 October 28, 2009 3:57 PM PDT
Wouldn't that just be fixed by right clicking and clicking "Run as Adminstrator" and then typing the username and password for the admin? Or are we still using outdated Windows XP?
by GalaxyFox November 1, 2009 8:11 AM PST
A bug is not something that is intentional. The Check for Updates is intentionally grayed out.

Just right click and Run as Administrator. Its not that difficult.

I agree with SergeM256 in the fact that non-admins could just request the admin password, but its not a bug.
by irondog1970 October 28, 2009 9:51 AM PDT
I would like to thank CNET for posting these articles. My company's firewall prevents Firefox's ability to check automatically for updates. So, the only way I knew 3.5.4 was released was through your article. (And, no, it doesn't make any sense that I can download 3.5.4 manually?)
Reply to this comment
by ittesi259 October 28, 2009 2:15 PM PDT
You could...I dunno check the Firefox website on occasion.....
by Imalittleteapot October 28, 2009 9:56 AM PDT
When I updated Firefox it told me my Flash was out of date and asked if I wanted to update to the newest version of Flash as well. In fact it recommended I update to the newest version. So, I did and went to the Flash site via the FF link that was provided and just clicked through everything without paying attention which was stupid and my fault. I know.

Then I double checked and made sure my Flash was updated for IE too by going directly to the site in IE.

But the point is, when installing the new Flash either through the FF prompt or through the IE ActiveX prompt (don't know which and perhaps both), somewhere along the way (because I wasn't friggin paying attention) Adobe sneakily installed McAfee Security Scanner or some crap on my machine as well which I didn't want!

Also with a nice shortcut put in the Start Menu's startup folder so something called McAfee Security Scheduler or some crap would run in the background on every boot of the computer. Like I need more crap running in the background every time I start my computer! Why would it have to run at startup every time I boot my computer to scan one single friggin download I'm only going to install once? Talk about friggin bloat! I have quickly removed said scanner.

Anyway, when doing the FF update, if it prompts you to update your Flash plugin and you don't use or like anything McAfee pay attention so you don't get a bunch of McAfee crap installed along with it from the wonderful people at Adobe along with your stupid Flash plugin.

You know it's crap when they can't sell it directly and they have to sneak it in behind enemy lines hoping someone doesn't notice the nefarious defaults. This goes for any company that ships those friggin toolbars with their software too. STOP IT! JUST STOP IT! If I want your software, I'll go to your site and get it. Stop piggy backing on other people's wares.

If you like McAfee though, then I guess it's not that big of deal.

Anyway, the point is just don't be lazy like me and pay attention.
Reply to this comment
by bousozoku October 28, 2009 11:39 AM PDT
It asks about the McAfee bit, but even though I clicked the checkbox to disable it, it still installed it.
by Imalittleteapot October 28, 2009 9:03 PM PDT
bousozoku:

Okay now that's just plain annoying. I've had someone else today tell me they disabled it as well and it still installed too. Oh well. At least it's fairly easy to remove.
by shellcodes_coder October 28, 2009 10:09 AM PDT
IE on Vista and 7 is more secure than Firefox because of Protected mode, though Firefox is way better than IE
Reply to this comment
by G-Skaf October 29, 2009 3:12 AM PDT
Everything is more secure on Vista/7, since people don't have to use an administrator account all the time :-)
by bornlikethis38 October 28, 2009 10:54 AM PDT
so after I upgraded to 3.5.4 none of my add-ons work
Reply to this comment
by Shankland October 28, 2009 11:28 AM PDT
What version did you update from? There are problems from 3.0.x series but 3.5.3 should be pretty easy going.
by GalaxyFox November 1, 2009 8:12 AM PST
Most add-ons work with 3.5.*. What add-ons are you referring to and what version did you update from?
by drbyte October 28, 2009 10:57 AM PDT
Flash runs like crap on firefox. DId they address that?
Reply to this comment
by Charleston Charge October 28, 2009 11:27 AM PDT
To be fair, Flash runs like that on all browsers.
by 4score20 October 28, 2009 12:12 PM PDT
I have to agree with drbyte. In my experience Flash vids sputter and stall in my copy of Firefox (3.5) but run smoothly in IE8 and Chrome. Still, it's not enough to make me use IE on a regular basis.
by drbyte October 28, 2009 2:09 PM PDT
I had hope when I googled and found someone attributed it to the snapshot firefox takes every 10 seconds for recovery from browser crash. The fix didn't help. Flash plays fine in chrome and IE, but I'm so used to firefox.
by ittesi259 October 28, 2009 2:16 PM PDT
To be fair....Flash is crap
by firefoxluva95 October 28, 2009 3:53 PM PDT
Even Silverlight runs better in Firefox than Flash. Flash is a resource hog.
by WelshMullet October 28, 2009 11:03 AM PDT
@shellcodes_coder firefox has a private mode as well :P
Reply to this comment
by kojacked October 28, 2009 11:58 AM PDT
IE Protected mode is not the same thing as FireFox private mode. IE "InPrivate" is the direct comparison. IE Protected mode deals with security not browsing for pr0n.
by cary1 October 28, 2009 11:31 AM PDT
my firefox updated and now I can't do text search on the page. This sucks
Reply to this comment
by tsinger254 October 28, 2009 11:44 AM PDT
My Firefox has never once crashed, until 15 seconds after I updated to the new version. Fortunately, I always (hopefully) check to make sure that other garbage isn't also being installed (as mentioned, above).

And it's really annoying that I have to physically go to each user's workstation, login as Admin, then update their software. It is so much easier when the "updates" is not grayed out, and I can simply type-in the Admin password.
Reply to this comment
by GalaxyFox November 1, 2009 8:13 AM PST
If you are running Vista+, just right click and click Run as Administrator.

Or you can just download the new Firefox exe package.
by malcarada October 28, 2009 1:13 PM PDT
Firefox needs to improve its popup blocking a lot, most pop ups get through.
Reply to this comment
by 86lg4b4c October 29, 2009 6:10 AM PDT
I agree.stopped using it because of the netflix pop under.Never seen this many pop ups get by with IE.Thier blocker just doesnt work.
by exactlyy October 28, 2009 1:26 PM PDT
the update process went smooth and like always ..Firefox w'll prevail .
Reply to this comment
by fjferrell October 28, 2009 1:29 PM PDT
Firefox became the nightmare and disaster that I feared would happened! Everything that could go wrong did happened. Firefox crashed and burned what has taken a year to get comfortable with.

My add-ons and plug-ins won't work; my Norton 2010 is in a tizzy keeping me out of firefox; and, worst of all, all the features that made my using Firefox a breeze keep telling me 'invalid errors' or "error 203"!!! What gives my ISP is no where the speed and convenience I once had with Mozilla.

I am not a techno-geek but when I follow the directions I expect results. What gives???
I need help and fast for some personal research endeavors dependon Firefox delivering the goods! My system is hurting and I need help!
Reply to this comment
by firefoxluva95 October 28, 2009 3:59 PM PDT
Here are your three problems:.
1. Norton
2. Norton
3. Norton
by kflgik October 29, 2009 6:31 AM PDT
Same issue when I perfored a required Norton 360 update restart. Have querried Norton but no response. Running Norton NIS 17.1.0.14
by kflgik October 29, 2009 6:49 AM PDT
Correction, I'm running NIS 2010.
by kflgik October 29, 2009 9:29 AM PDT
Norton required restart of 17.1.0.14 update caused Firefox 3.5.3 and 3.5.4 to go on the blink. Norton fell back and deinstalled 17.1.0.14 to 17.0.0.136 and Norton toolbar, etc and Firefox addons started working again. Unfortunately Norton lost over 2 years of passwords when they deinstalled and reinstalled.
by GalaxyFox November 1, 2009 8:14 AM PST
I'm running Norton IS 17 (2010) as well and have no problems at all.
by Vegaman_Dan October 28, 2009 1:35 PM PDT
I'm curious why it is that it seems like all the browser security issues could lead to remote execution of vode on a browers or allow remote access to the host system. Why not have issues like- oh... if you click on two links too quickly while the space bar is down that the screen turns pink and green and your mouse cursor turns into a flying hippopotamus? That would be more entertaining. :)
Reply to this comment
by Imalittleteapot October 28, 2009 9:05 PM PDT
If I still had enough free time like I used to, I swear I would find a way to make that happen LOL.
by G-Skaf October 29, 2009 3:13 AM PDT
It may already have happened with IE. Everything is possible there :-P
by fjferrell October 28, 2009 1:35 PM PDT
My system just totally crashed again after reinstalling Firefox 3.5.4 and updates!!! What gives??? I need my computer! Please help for this is frustrating!
Reply to this comment
by cuz84d October 28, 2009 2:34 PM PDT
by 4score20 October 28, 2009 12:12 PM PDT
" I have to agree with drbyte. In my experience Flash vids sputter and stall in my copy of Firefox (3.5) but run smoothly in IE8 and Chrome. Still, it's not enough to make me use IE on a regular basis."

To fix Flash performance on Firefox, the network/perf is affected by session restore capturing restore history every 10 seconds. This can be easily changed via pref change in Firefox.

Here are the steps to improve flash performance on Firefox.

1. Open a new tab

2. type about:config in the location bar
3. hit enter
4. click the button past the warning page.
5. Type "browser.sessionstore.interval" in the search field.
6. Change the value to something like 120000 for every 2 minutes or 300000 for every 5 minutes.

10000 = 10 seconds session capture of all the tab/forms and other things etc so it can be restored if you do quit and save or run into a crash, your data comes back up. Try doing that with IE.

Flash will work much better afterward!
Reply to this comment
by cuz84d October 28, 2009 2:35 PM PDT
Firefox 3.5.4 is way better than 3.5 (which had a noticeable performance bug fixed by 3.5.1).
Reply to this comment
by SJ2571 November 21, 2009 7:34 PM PST
Can anyone explain why there is a 3.0 and 3.5 release anyway? Why are Mozilla maintaining two versions? Ditch the 3.0 I say. Why bother supporting it?

Also, when is the bug of favicons EVER going to be fixed? I've got a YouTube logo next to Yahoo's link, for example. So sick of that, and it's never fixed with each new update.
Reply to this comment
(46 Comments)
  • prev
  • 1
  • next
advertisement

The yogurt makers of tech: Gadgets to avoid

Don't buy these one-trick ponies--unless you like gizmos that gather dust.

Google wants to unclog Net's DNS plumbing

The Net giant, ever eager for a faster Internet, debuts its Google Public DNS service. With it, Google could become even more central to the Net.

About Deep Tech

Stephen Shankland, who's covered the computing industry since 1998 and was a science reporter before that, here delves into a wide range of technology trends and offers hands-on tests. His particular interests include Web browsers, cameras, standards, research, science, and start-ups.

Add this feed to your online news reader

Deep Tech topics

advertisement
advertisement

Inside CNET News

Scroll Left Scroll Right