http://blog.mozilla.com/security/category/security/URL bar spoofing vulnerability07.28.09 - 03:40pm Issue Locking up the valuables: Opt-in security with ForceTLS07.27.09 - 05:17pm Computers are increasingly mobile and, to serve them, more and more public spaces (cafes, airports, libraries, etc.) offer their customers WiFi access. When a web browser on such a network requests a resource, it is implicitly trusting the hotspot not to interfere with the communication. A malicious computer hooked up to the network could alter [...] How Mozilla finds crash bugs07.20.09 - 05:36pm This Tuesday (2009-07-21), I’m organizing a crash bug triage day
where anyone interested can help us classify the swamp of open crash
bugs. Join us in #bugday on irc.mozilla.org if you’d like to help. milw0rm 9158 “stack overflow” crash not exploitable (CVE-2009-2479)07.19.09 - 02:44pm In the last few days, there have been several reports (including one via SANS) of a bug in Firefox related to handling of certain very long Unicode strings. While these strings can result in crashes of some versions of Firefox, the reports by press and various security agencies have incorrectly indicated that this is [...] Critical _javascript_ vulnerability in Firefox 3.507.14.09 - 10:15am Issue Shutting Down XSS with Content Security Policy06.19.09 - 03:41pm For several years, Cross-Site Scripting (XSS) attacks have plagued many of the web’s most popular sites and victimized their users. At Mozilla, we’ve been working for the last year on a new technology called Content Security Policy, designed to shut these attacks down. We wanted to give a bit of background on this [...] Measure What Matters – The SEC Essentials04.22.09 - 11:06am People want to know that they are safe when they browse the web. There are important differences between browsers when it comes to security, and so it’s no surprise to see a growing number of groups out there attempting to compare browsers based on their security record. That’s great news; not only does it help [...] CanSecWest 2009 Pwn2Own Exploit and XSL Transform Vulnerability03.26.09 - 01:55pm Issue New CSS Grammar Fuzzer03.17.09 - 01:24pm Mozilla’s Jesse Ruderman just blogged about a new CSS grammar fuzzer
of his, to go along with the JS fuzzer we announced a while ago. Beware the Security Metric03.06.09 - 02:50pm Security metrics are very difficult to do well, and easy to do
poorly. For example, take a look at the recent Secunia “2008 Report”
(http://secunia.com/gfx/Secunia2008Report.pdf). It tries to break down
vulnerabilities reported by browser, and specifically states: |
