Print - Numerous Security Flaws in Web Browsers Remain Unpatched

Dozens of security-related problems remain unpatched in Internet Explorer, Firefox, and Opera Web browsers. According to security solution provider Secunia who tracks vulnerabilities in over 4000 products, some of the unpatched browser vulnerabilities are considered to be either moderately or highly critical.

Secunia's reports show they're currently tracking 63 advisories for Internet Explorer 6 . Of those advisories, 41 of the problems have been either corrected or partially corrected by patches from Microsoft. One of the problems is correctable with workarounds. The remaining 21 security problems remain unpatched, the oldest of which was reported in March of 2003.

The reports show that of the 8 advisories tracked for Firefox , 6 of the problems remain unpatched while the remaining 2 have either been completely or partially corrected with patches from the Mozilla Foundation. The oldest unpatched vulnerability in Firefox is dated August 2004.

Secunia currently tracks 33 advisories for Opera 7.x, where 30 of those problems have been corrected by patches from Opera Software. The remaining 3 problems, the oldest of which is dated October 2004, remain unpatched.

"8 advisories tracked for Firefox". Quite alarming for a fresh 1.0 browser... :-/ Where are the updates? There's no updated binaries to install. And compared to the MSIE 6 "63 advisories". MSIE6 is now an old browser with no major updates apart from WinXP SP2.

This certainly shows Opera in a positive light (which as an Opera user I'm rather pleased by!). Particularly when you look at the three outstanding issues and find that two are fixed in the imminent 8.0 release (in beta for ages now) and the other is not actually a 'flaw' in Opera per se, but rather their correct implementation of the fundamentally flawed IDN system. I'll never understand why Firefox is such a media darling and Opera so overlooked, and I don't see anything here to explain this either. Oh well!

-Firefox has NO vulnerabilities rated above "moderate". Both IE & Opera have "extreme" & "high" critical flaws. -altho I didn't see a breakdown, I doubt either Opera or Firefox exhibit these vulnerabilities outside the windoze platform. -why is Firefox a darling? because of good marketing, good "genes" (from Firebird), a happy & well-embedded user community, the free version doesn't do ads or "nag-ware" (unlike the free version of Opera)...shall I go on?

There are lies, damned lies and statistics. Number of "issues" in mozilla is 8. none of them are highly or extremely critical. 2 moderate and 6 not critical. Number of extremely and highly critical issues with IE is 26. Microsoft gets the high "resolved" percentage by resolving stupid trivial issues. Further the fix from Mozilla/FF will work on all platforms including Win98. Mircosoft counts as "fixed" if it is fixed in WinXP. As I said, there are lies, damned lies and statistics.

Considering that the content of this article really didn't serve much purpose to begin with and was rendered out of date in less than 24 hours by the release of Firefox 1.0.1, maybe Mark Joseph Edwards could just spare us all and pull a Hunter S Thompson now.

I must say I'm a but annoyed that FireFox 1.0 hasn't detected the availability of Firefox 1.0.1 yet. And the Secunia web site is deliberately vague about what version it is referring to, or what the impact of the "Partial Fixes" is. i.e. Does a moderate vulnerability that is "Partially fixed" remain a "moderate" vulnerability or does it get downgraded to "low"? There seems to be a lot of FUD being generated here.