On Tuesday, November 8, Mozilla released version 8.0 of Firefox and Thunderbird. Details of what is included in the new release are available from the following URL – http://www.mozilla.org/en-US/firefox/8.0/releasenotes/

Additionally, several security vulnerabilities were addressed with the release of Firefox 8.0 and also Thunderbird. Please see the following URLs for details.

Firefox – http://www.mozilla.org/security/known-vulnerabilities/firefox.html#firefox8

Thunderbird – http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html#thunderbird8

A number of vulnerabilities have recently been identified in Firefox 6 and all 3.6 versions prior to 3.6.23.  It is recommended that version 7 be installed as soon as possible.   Similar vulnerabilities have been identified in Thunderbird and SeaMonkey versions prior to 2.4. Please download the latest versions from mozilla.com

 

Some problems have been identified with version 7 of Firefox with flash videos. The solution seems to be to update flash. After installing version flash version 11 the problem was addressed.

 

https://support.mozilla.com/en-US/kb/Flash-based%20videos%20and%20sound%20do%20not%20play%20correctly#os=win&browser=fx7

An updated version of Firefox was released on 6/23 – It can be downloaded from
http://download.mozilla.org/?product=firefox-3.6.4&os=win&lang=en-US (Windows)

Other OS versions at – http://www.mozilla.com/en-US/

According to SANs, it fixes seven vulnerabilities

http://secunia.com/advisories/35914/

Critical:       Highly critical
Impact:     Cross Site Scripting
        System access
Where:     From remote
Solution Status:     Vendor Patch

Description:
Some vulnerabilities have been reported in Mozilla Firefox, which can be exploited by malicious people to conduct cross-site scripting attacks or compromise a user’s system.

1) Multiple errors in the browser engine can be exploited to corrupt memory and potentially execute arbitrary code.

2) An integer overflow error in a base64 decoding function can be exploited to corrupt memory and potentially execute arbitrary code.

3) An error in the handling of multiple RDF files in a XUL tree element can be exploited to corrupt memory and potentially execute arbitrary code.

4) An error exists in the construction of documents, which can result in double copies of certain elements within this document.

5) An error in the handling of frames can be exploited to cause a memory corruption and potentially execute arbitrary code.

6) Multiple errors in the Javascript engine can be exploited to corrupt memory and potentially execute arbitrary code.

7) An error in the handling of Flash objects when navigating to another page can potentially be exploited to trigger a call to a deleted object and potentially execute arbitrary code.

8) Multiple vulnerabilities in various font glyph rendering libraries can be exploited by malicious people to compromise a user’s system.

9) An error in the handling of SVG elements on which a watch function and __defineSetter__ function have been set for a certain property can be exploited to cause a memory corruption and execute arbitrary code.

10) An error when setTimeout() is invoked with certain object parameters can result in the object loosing its wrapper. This can potentially be exploited to execute arbitrary Javascript code with chrome privileges.

11) Various errors in the handling of wrappers for objects can potentially be exploited to access properties of such objects that have been set by a different site and e.g. conduct cross-site scripting attacks.

Solution:
Update to version 3.0.12.