Update
After blocking Microsoft's WPF plugin for Firefox due to what it believed was a security vulnerability, Mozilla has removed the block. The blocklist has been updated, but will take some time to propagate to clients, which will then be able to continue using the WPF plugin.

Original story
Mozilla has temporarily disabled Microsoft's WPF plugin for Firefox in order to protect users from a security vulnerability that was recently uncovered in the component. The vulnerability can be exploited when users visit malicious Web pages that contain specially crafted XAML content.

Microsoft issued an Internet Explorer patch to fix the vulnerability through its Windows Update mechanism on Tuesday. The IE patch is said to fully resolve the vulnerability for Firefox users in addition to users of Microsoft's own browser. Mozilla is concerned, however, that not all users have performed the Windows update yet. In order to protect users who are not yet patched, Mozilla has added Microsoft's plugin to its add-on blocklist, causing it to be automatically disabled by the browser. more detail: linux.com/....firefox

The IE Cumulative Security Update for October 2009 is now available via Windows Update or Microsoft Update.  This update addresses three privately reported vulnerabilities and one publicly disclosed vulnerability. The security update addresses these vulnerabilities by modifying the way that Internet Explorer processes data stream headers, validates arguments, and handles objects in memory. For detailed information on the contents of this update, please see the following documentation:

• Microsoft Security Bulletin MS09-054
• Microsoft Knowledge Base Article 974455

This security update is rated Critical for all supported releases of Internet Explorer: Internet Explorer 5.01, Internet Explorer 6, Internet Explorer 6 Service Pack 1, Internet Explorer 7, and Internet Explorer 8.

As a reminder, IE security updates are cumulative and contain all previously released updates for each version of Internet Explorer.

It’s well understood that the typical computer users today spend much of their time in their web browser, making it the most important software on their computer. Users expect their browsers to be easy to use, fast, stable and secure.

Over the past few months, users have downloaded thousands of great browser add-ons from www.ieaddons.com and other web sites. Users want to use browser add-ons to enhance their browsing experience, not hinder it or make it more confusing.

MSDM have published a full list of guidelines to help add-on developers create quality add-ons. MSDN team created these guidelines to respond to demand from the developer community and to help share the thinking of the IE team, gathered from years of providing support to users and developers. MSDN team strongly recommend that developers follow these guidelines when developing add-ons for IE users. MSDN team occasionally come across add-ons that violate these guidelines so egregiously that MSDN team treat them as malware; on the other hand, MSDN team frequently see really helpful and creative add-ons that put the “user in control” and enhance the browsing experience. Here are the core aspects of our guidelines:

Do not limit the user’s ability to access Internet Explorer features.
Users require access to the entire set of Internet Explorer features, including but not limited to: the address bar, search box and new tab page to navigate and search the Internet easily and safely. Users expect these features to be available to them at all times and our support data shows that users are confused and unhappy when these features are obscured or changed. Please don’t write add-ons that hide, obscure or limit access to Internet Explorer features.

Do not limit the user’s ability to control Internet Explorer settings
It’s important that users be able to control their browsing experience. MSDN team provided many configuration options for IE users to help them set up their browser exactly how they want it and protect themselves from potentially harmful malware.

To support this guideline, add-on software should not remove or limit the user’s ability to view and modify IE settings.

Only use supported APIs
Add-ons should only use supported Internet Explorer and Windows application programming interfaces (APIs), detailed on MSDN web. Using an unsupported method of extending Internet Explorer or relying on implementation details in a specific version of IE may cause browser stability problems when Internet Explorer is updated. Also, when two add-ons try to use the same unsupported method of extending Internet Explorer they might crash the browser – our APIs are specifically designed to prevent this kind of problem.

Microsoft is committed to working with all add-on software developers to ensure that our mutual customers – you, the user – have a great experience when using Internet Explorer with add-ons. If you are developing or maintaining an Internet Explorer add-on, please review our guidelines and ensure that your add-ons deliver a good long-term experience for users.