Security Week in Review (2008-04-13)

There was a flurry of updates last week. It kept things quite busy and crazy. There wasn't much else going on (at least not much else I noticed).

Firefox
There was another Firefox update on the heels of the last one. This was to fix a quite serious flaw discovered in the way Javascript is handled. Firedrill updates are never much fun, but as usual all the pieces eventually fit together and updates made it out. Be sure you're running the latest browser, as it's easily the easiest entry point into a system.

OpenOffice.org
The OpenOffice.org upstream made the unfortunate decision to release a new version (2.4), but not mention that it fixed a number of security flaws until almost a month later.
The news page makes reference of this.

Practices such as this can be quite dangerous, as people will read the release notes, think there are no security updates, then possibly not upgrade. In reality there isn't a huge threat here, it's more just bad practice. Silent security fixes are never a good idea, and have gotten numerous other organizations in hot water.