Mozilla rebuts Firefox 2.0 bug claims

A day after shipping Firefox 2.0, Mozilla largely rebutted two claims of security flaws in the latest version of the web browser.

Bug hunters appear to be in a race to uncover new security flaws in both Firefox 2.0 and Internet Explorer 7, which Microsoft released last week.

At least two bug reports that indicated they affected the new Firefox release crossed over popular security mailing lists this week.

But Window Snyder, Mozilla's security chief, said: "I would call it just noise." The two issues don't present any real risk to Firefox users, she said.

One of the problems is related to a vulnerability that was patched in an earlier version of Firefox. A report on the Bugtraq mailing list suggested that the issue, labelled "critical" by Mozilla, resurfaced in Firefox 2.0.

The report is incorrect, Snyder said. "The vulnerabilities that were identified were actually fixed," she said.

However, there is a related problem that can cause Firefox to crash. Snyder said: "The exploitable issues are fixed. There is a crash but it is a denial of service. We're going to look at it and make sure there is really nothing there."

Another report on the Full Disclosure mailing list suggested there is a flaw in Firefox 2.0 that could be exploited to aid in cyber scams. The report included some computer code but not enough for Mozilla to determine whether there is a problem, Snyder said.

She said: "We don't have enough information to identify it. If we get more information, then we will investigate."

Mozilla shipped Firefox 2 on Tuesday, nearly a week after Microsoft released IE 7. Both browsers have an emphasis on security and include features such as phishing shields to protect against fraudulent, data-thieving websites.

Mike Schroepfer, vice president of engineering at Mozilla, said: "This is one of the highest quality Firefox releases to date. We fixed more issues than we ever have before. All empirical and anecdotal evidence so far shows that this is one of the most solid and stable Firefox releases."

Security researchers are welcome to hunt for bugs in Firefox, Snyder said. However, those bugs should be reported responsibly to Mozilla, instead of disclosed publicly, she said.

Snyder added: "We think it is great that the security community is working so hard to help us identify bugs. Once they are identified, we're able to fix them and we fix them quickly and that means customers are less at risk."

Joris Evers writes for CNET News.com