For the record, I got the server updated Monday night.
That list of FireFox vulnerabilities is illuminating, and not in a good way, because most of them are a consequence of the philosophy of open-source development.
(I'll have to make this quick because I anticipate the Linux Lynch Mob to arrive soon.)
FireFox is built out of Mozilla components, which are intended to be a kind of "Lego™ Set" to plug together parts to create something loosely categorized as a Web browser. It's intended by design to be an open system, and therin lies the problem: The boundaries are unclear, and there are too many interfaces exposed to keep track of; and through these myriad channels, JavaScript on a Web page has too many chances to dig inside the browser and mess with its guts.
Here's one example: "Privilege escalation through XUL persist". XUL is a way to customize the appearance of FireFox; it's the language in which the FireFox interface is built. It's nice in principle to expose it for customization, but this bug reveals that it opens a serious security hole. "Privilege escalation" means that the JavaScript can give itself System Administrator privileges on your computer.
Which works nicely with another vulnerability: "File stealing by changing input type". With higher security permissions, you can steal a better class of file. Hackers try to be upwardly mobile.
"Privilege escalation using"...oh crap, the lynch mob's almost here. Got to cut the geekiness short (I know, I know, no tears now, I'll be back)...
Geek Speak » in reply to Security updates
Thanks
