Mozilla 'temporarily' pulls Firefox 16 to address security flaw

[Brink]

Just a day after its debut, Firefox 16 has been "temporarily removed" pulled from Mozilla's installer page while it addresses what is apparently a serious security flaw in the browser's latest version.

"The vulnerability could allow a malicious site to potentially determine which websites users have visited and have access to the URL or URL parameters," Michael Coates. Mozilla's director of Security Assurance, said on the company's security blog. "At this time we have no indication that this vulnerability is currently being exploited in the wild."

Read more at source:
Mozilla 'temporarily' pulls Firefox 16 to address security flaw | Security & Privacy - CNET News

 

[A Guy]

One day after the release of Firefox 16, Mozilla said it has "temporarily removed" the latest version of its browser because of a security flaw that the company is trying to fix as quickly as possible. The unusual precaution suggests the flaw is a serious one, but there are no reports of it being exploited.

Source

A Guy

 

[Phone Man]

Thanks for the update Shawn.
That's why I always install each new FF version in its own folder. They share the same profile so I can test the new version for any conflicts and still use the older version if needed. Back using 15.0.1 until FF 16 is fixed. I can now just open FF 16 and check for updates.

Jim

 

[lehnerus2000]

"Rush the new versions out" policy

Great I just updated yesterday (I thought that they'd break something).

They should abandon this stupid "Rush the new versions out" policy.
Since they introduced it, almost every update has had to be updated (within a few days) to fix some stuff up.

If they want to outdo Chrome, just release a version called "Firefox 100".
Problem solved.

 

[Bertison]

Thank you, Shawn.

Not updating yet. Perhaps this is a sign of how popular FF is.

Or (more likely) that the FF team are pushing out versions and u/g's too hastly, as lehnerus says.

 

[theveterans]

Mozilla should keep their rapid release plan, but only increasing the digit after the version number. Firefox 16 should be called Firefox 4.16 since there is very little change in the UI from version 4. Mozilla should just change the version number when there is a radical change in its appearance.

 

[Phone Man]

FF has released 16.0.1 and is available through FF update.

Jim

 

[jadinolf]

They sure came back with a fix real fast.

Hope it's good.

 

[SIW2]

If you want to keep the installer - you can d/l FF16.01 direct:

https://download.mozilla.org/?product=firefox-16.0.1&os=win&lang=en-US

 

[King Arthur]

They should've used this opportunity and gone for Firefox 17. Larger version number is always better after all!
</sarcasm>

 

[SIW2]

LOL.

I dunno why people are having a go at Mozillla.

There are bugs/flaws in every piece of software - especially windows - that's why there are so many windows updates.

Mozilla fixed it as fast as they could.

Well done for that Mozilla.

 

[gregrocker]

I want to be able to drag my 270 Bookmarks into 7F posts again intact and maintaining the names I have given them, not converting them to a URL where I cannot manipulate the name. This changed in v.13 causing me to have to stick with v.12.

I filed a bug report and could not communicate to them exactly what the problem is. They were either being obstreperous or dense. Either way they didn't seem to care. It is a specialized usage. It is also the only browser that can do this.

 

[lehnerus2000]

Maybe it's because ...

I dunno why people are having a go at Mozillla.

Maybe it's because:

• They should have tested it before releasing it (see below).
• It seems the release schedule is more important, than "dotting the i's and crossing the t's".

There are bugs/flaws in every piece of software - especially windows - that's why there are so many windows updates.

Mozilla fixed it as fast as they could.

An Internet Browser should be simpler than an OS.

It must have been something simple, because the patch came out quickly (just like the previous times I alluded to earlier).
IMO, this indicates that they didn't test it properly.

I want to be able to drag my 270 Bookmarks into 7F posts again intact and maintaining the names I have given them, not converting them to a URL where I cannot manipulate the name. This changed in v.13 causing me to have to stick with v.12.

The Bookmark Manager needs to be totally overhauled (the Session Manager too).

I have ~18,000 bookmarks divided amongst my 7 FF profiles.
Keeping them organised is a nightmare.

I filed a bug report and could not communicate to them exactly what the problem is. They were either being obstreperous or dense. Either way they didn't seem to care. It is a specialized usage. It is also the only browser that can do this.

When I was using the Alpha versions (last year) the feedback site would only accept my comments if they were praise (complaints wouldn't post).

They obviously don't want to receive bug reports.
Every time I try to report an issue (the last time was a css issue with FF13) the site demands that I sign up to some Google service.

I refuse to sign up to Google services.
I'm sure that Google already has an extensive dossier on me.

Still Mozilla has me "over a barrel" as I don't like IE and I won't use Chrome.

 

[gregrocker]

Their Sync does work good for moving between my PC's as new bookmarks and URL, search and other history is already loaded when I open it on another machine I've sync'd.

Ironically I've forgotten which of 9-10 devices I set up the original Sync upon so wonder if it ever goes bye whether my whole Sync empire collapses.

Are the profiles you're referring to tied to your OS User account, or can you set them up in the browser itself?

 

[lehnerus2000]

FF Profiles - profiles.ini

Are the profiles you're referring to tied to your OS User account, or can you set them up in the browser itself?

I meant FF Profiles.
The "profiles.ini" file tells FF where to look for the FF profile(s).

http://www.sevenforums.com/tutorials/208070-firefox-create-run-multiple-profiles.html
I should have included instructions on how to move your profiles to a new location.

All you have to do is:

• Copy your profile(s) to the new location
• Edit "profiles.ini" so that it points to the new location
• Delete the old Profiles after you are sure the new ones are working

I have my FF Profiles set up on my Documents partition.
I used to point XP and W7 to that location and I could use the same profiles in both operating systems.

Firefox was a bit crash happy in my XP install, which meant that I would lose my sessions (I always leave 20+ tabs open).
I stopped pointing my XP FF install at them as a result.

Even though I reinstalled my operating systems last month, FF still crashes the 1st time I start it in an XP Session.
It runs correctly on subsequent starts.

Depending on your add-ons you should be able to point a Linux OS at them too.
Some add-ons only work in Windows and some only work in Linux.
If you don't use any add-ons, it should work with no problems (I haven't tried it though).

Obviously if an add-on points uses a path it won't work in both operating systems.
It might be possible to write a script to convert paths based on the OS you are using.

I only have limited scripting skills though.

With experimentation it should be possible to determine, which add-ons are safe for both operating systems.
For example, I wouldn't be surprised if NoScript worked without problems.

 

[gregrocker]

I'm trying to figure out if I need another profile.

 

[lehnerus2000]

Multiple FF Profiles can be handy

You do have to update the add-ons in each profile separately though (if you're not using auto-updating).

I created mine because FF seemed to struggle to start, with the all of my bookmarks in the same profile.
Managing all of my bookmarks was problematic too.

 

[A Guy]

Exploit Code Released Targeting Firefox 16 Vulnerability

It’s been an interesting couple of days for Firefox users. First Mozilla released version 16 of the popular browser on Wednesday, then quickly pulled it back yesterday after a serious security vulnerability was found in the new version. Less than 12 hours later, Mozilla had repaired the problem and re-released the updated browser, but not before exploit code was released.

The attack exploits an issue where Firefox was exposing URL information across Web domains by not restricting Javascript’s location method. Mozilla director of security assurance Michael Coates said the vulnerability could allow a malicious website to determine which websites a user had surfed to and would leak URL information.

Source

A Guy