Glaswegian

Mozilla has rushed out a new version of Firefox in order to fix a flaw it introduced with the 12-patch security update it shipped less than a week ago.

Firefox 3.0.10, which the open-source browser maker called a "security and stability" release, follows Firefox 3.0.9 by just six days, and was necessary because of a new bug that slipped into last week's update.

Mozilla labelled the new bug a critical security vulnerability. "One of the security fixes in Firefox 3.0.9 introduced a regression that caused some users to experience frequent crashes," the accompanying advisory said. "In analysing this crash, we discovered that it was due to memory corruption similar to cases that have been identified as security vulnerabilities in the past."

The flaw, which cropped up only in the Windows version of Firefox, was detected by Mozilla's crash reporting system, and by last Wednesday, developers were discussing how to deal with the problem on Bugzilla, the company's bug tracking system.

"So we fixed [bug] 431260, which wasn't really a security problem, and we introduced this bug, which probably is," said Robert O'Callahan, a Mozilla developer who works on Firefox's rendering engine. "Perhaps we need to be more picky about what we land on branch."

By Thursday, a patch had been created and the new build had been passed on to testing.


http://www.techworld.com/security/ne...&NewsID=115087