New Releases - Mozilla 1.7.1, Firefox0.9.2, T-Bird0.7.2

http://ftp.mozilla.org/pub/mozilla.org/mozilla/releases/mozilla1.7.1/

http://207.200.85.49/pub/mozilla.org/firefox/releases/0.9.2/

http://207.200.85.49/pub/mozilla.org/thunderbird/releases/0.7.2/

Details can be found here: http://mozillazine.org/

Branches have been created for three of mozilla.org's latest releases, in order to fix an external windows protocol handler bug. The fix involves disabling the shell: protocol handler, which was found to enable pages to run executables on Windows via a link. Builds should officially be available shortly, and there will also be an XPI offered to disable the pref. Alternatively, you can set the pref "network.protocol-handler.external.shell" in about:config to 'false' to also remove the exploit.

Now that the binaries have been issued the workaround won't be needed. More information about the exploit can be found here:
http://seclists.org/lists/fulldisclosure/2004/Jul/0335.html


Ramona

 

Mozilla 1.7.1

Hi Ramona,

I saw this article at mozillazine. I just ordered Mozilla 1.7 on cd and got an e-mail saying it was sent out today. Should I install it? Is this newer version patching a security hole? Would like your advice on how to handle this as I am not as computer savvy as some here.

Thanks!

 

Hi Jeane,

If you have ordered the CD, and there is some reason you don't want to download the new Release, then you can apply the workaround, once your CD is received, and you have installed Mozilla 1.7.

The patch is named shellblock.xpi. You can install it while online, by simply clicking on this link: shell.xpi

In Mozilla 1.7, you must enable Software Installation. That setting is found here: Edit | Preferences | Advanced | Software Installation

Once you have installed the patch, then I would advise DISabling not only the software installation, but also the "Check for Updates" setting.

Ramona

 

New update

Hi Ramona,

I just recently saw this at mozillaZine:
Today, the Mozilla team released a configuration change which resolves this problem by explicitly disabling the use of the shell: external protocol handler. The fix is available in two forms. The first is a small download which will make this configuration adjustment for the user. The second fix is to install the newest full release of each of these products. Instructions on administering these changes can be found below.

How to update
Mozilla, Firefox and Thunderbird users on Microsoft Windows operating systems should update in one of the following ways.

To install the security patch for Mozilla or Firefox, follow these instructions:
Click Install Patch.
In the Software Installation window, click the "Install Now" button.
Exit and restart your Mozilla or Firefox browser.

I'm assuming that I could install with the CD and apply this patch. Is that correct?

 

Hi Jeane,

Yes, that's exactly correct, and what I just said in the above post:

The patch is named shellblock.xpi. You can install it while online, by simply clicking on this link: shell.xpi

In Mozilla 1.7, you must enable Software Installation. That setting is found here: Edit | Preferences | Advanced | Software Installation

Once you have installed the patch, then I would advise DISabling not only the software installation, but also the "Check for Updates" setting.

If you have any more questions please let us know. Don't be nervous about the install, it will be fine.

Ramona

 

Ramona, you are the best! Thanks for the help.

I sometimes get nervous asking questions here because I feel so stupid -- I am a bit slow as you can tell. I was confused because there was your instruction, and then I saw that you could just click on update and wanted to make sure they were the same thing.

 

My Dear Jeane,

Please, please, never feel stupid about asking a question. The only stupid thing on these Forums, is when members DON'T ask questions. How else will you learn if you don't ask questions? Believe me, if you had been around a few years back, you would have seen me asking much more basic questions than you've ever asked!

That's a good idea to update the page, because sometimes it gets hot and heavy here, and some threads are constantly changing.

Let us know any time that any issue is not perfectly clear to you. That's why we're here.

Ramona

 

Thanks Ramona for the tip on the latest Firefox 0.9.2.
I grabbed it this morning and it seems a little "snappier" than previous versions.
I am including Firefox in every new computer build I do for people here in my area.

Daddad

 

Fearless Leader,

Thanks for that bit of information! Things that make you go hmmmmmmm? Maybe it's Mozilla's way of making you report crashes whether you want to or not...

Ramona

 

Daddad,

Interesting to hear that Firefox 0.9.2 is a bit snappier. How terrific that you add the browser to your new custom build PC's! I sure wish I lived in your area, as I'm looking into a custom build for myself. Wow, if only more folks like you would do the same with this browser, Mozilla Firefox would become a household name. When I tell people that I volunteer on Netscape/Mozilla technical BBS', they usually ask me "what's Mozilla? ". You should let the folks on MozillaZine know that you do this...

Ramona

 

Good morning Ramona
When I say "snappier" than previous versions, I am refering to all the versions I have tried going back to the original version (Firebird 0.7) that was supplied as a zip file.

I have 3 browsers on my machine now.
IE-6, Mozilla 1.7b and Firefox 0.9.2

I have CNN.com as my home page on all three browsers.
In order of speed in loading the complete page, Firefox is the fastest hands down, then comes IE-6 and the slowest is Mozilla 1.7b.

I have cable internet here through Comcast at 3000 down.

In regards to your new custom build, send me an email or a PM and let me know what you desire in the new machine (hardware wise) and I can offer suggestions on what I am currently using.

As you can tell, I am an quality freak here by my machine layout below.
I NEVER have any of my machines "come back" for post build problems using the parts I use.......

Daddad

 

Ramona,

Just curious. What is reason for disabling the "Check for Updates. "

Thanks,

Jeane

 

Hi Jeane,

Because you want to control what is downloaded/installed on your PC. It's always best to disable any automatic software installation by any program without your authorization first.

Ramona