February 23, 2007 2:16 PM PST
Mozilla releases security updates
"Due to the security fixes, we strongly recommend that all Firefox users upgrade to these latest releases," Mozilla said in a post on its development site.
"This update resolves the location.hostname vulnerability and other security and stability issues," Mike Schroepfer, vice president of engineering at Mozilla, said in a statement.
The location.hostname vulnerability that Schroepfer referred to was the Firefox cookie flaw discovered by Michal Zalewski, an "ethical hacker" from Poland.
In mid-February, Zalewski posted his proof-of-concept on a mailing list for other security experts. His note said that a flaw in Firefox could allow hackers to set or change cookies, permissions for Web site settings and passwords, for their own purposes. A fix for the high-impact flaw was made by Firefox developers last week.
"Thanks to the work of our contributors we have been able to address these issues quickly in order to minimize the security risk to Firefox users," Schroepfer said.
The update is available in 37 languages from the GetFirefox.com and GetThunderbird.com Web sites for 220.127.116.11 versions of Firefox and Thunderbird, as well as Firefox 18.104.22.168. It is also scheduled to be available as of late Friday afternoon by clicking "Check for Updates..." in the Firefox Help menu.