Keeping plugins up-to-date

Keeping browser plugins up-to-date is important for security because older versions of plugins often contain severe security holes that are known to the world. It's actually more common for Firefox users' computers to be compromised through holes in an old version of Java than it is for them to be compromised through holes in old versions of Firefox; Mozilla's bug database contains several bug reports to the effect of "I was using Firefox and got infected with spyware" that were determined to involve Java exploits.

You should only have to do this once, because as of December 2006, most of these plugins include an automatic update feature. There are a few exceptions, such as Acrobat reader (see below).

This page only tries to be accurate for Windows.

Flash

The About Flash page tells you what version you're using and what the newest version for your platform is.

Java

Use this page to determine whether you're using the latest version of Java. If you're using a version of Sun Java for Windows older than 1.5.0_09, download a newer version from Sun.

Acrobat Reader (PDF)

If loading this PDF causes "Acrobat Reader 7.0" to appear in the upper-right corner of your browser content area, you should update to Acrobat Reader 8.

Acrobat reader 7.0.8 contains known security hole, but does not tell users that they should update to Acrobat 8. It's not clear to me whether this security hole affects the plugin or only the standalone viewer, but either way, using the latest version is probably a good idea.

QuickTime

To check your version, load a video such as this one from Lisa Rein's archive of Daily Show clips, right-click, and select "About QuickTime Plugin" from the context menu.

Check the Apple Quicktime download page to find out what the latest version is.

Additional comments

It is unfortunate that on Windows, each plugin must supply its own automatic update feature:

• Many plugin updaters simply download a new version of the plugin, which uses more bandwidth than a binary diff would.
• It increases the attack surface. A security hole in any automatic update feature could be disastrous for users near compromised routers or relying on untrusted wireless networks.

In addition, some plugin makers seem to go out of their way to make the update process unpleasant. Flash and Java updates bundle browser toolbars by default, and updates to Acrobat reader often require rebooting Windows multiple times.

Because of these problems, some users choose to disable plugin automatic update features :(

Hopefully, future versions of Firefox will warn when you have outdated plugins; see bug 271559. Or maybe even update the plugins for you?