Mozilla patches three public Firefox bugs
Mozilla today patched Firefox 3.5 and Firefox 3.0 to quash three security vulnerabilities, including a pair unveiled last week at Black Hat, and a third Mozilla itself revealed last month.
Firefox 3.0.13, the update to the older browser that Mozilla will drop off the support list in January 2010, includes two bugs, while Firefox 3.5.2 fixes a separate flaw.
The vulnerabilities patched by Firefox 3.0.13 were disclosed last Thursday by Dan Kaminsky of IOActive and a security consultant who calls himself Moxie Marlinspike, at Black Hat in Las Vegas. Independently, Kaminsky, best known as the discoverer of the DNS (Domain Name Server) vulnerability last summer, and Marlinspike demonstrated how hackers could exploit flaws in browsers' implementation of SSL (Secure Socket Layer), the Web's default encryption protocol.
