Mozilla Firefox - Two Vulnerabilities

[Nomad559]

Mozilla Firefox - Two Vulnerabilities

Extremely critical

Description:
Two vulnerabilities have been discovered in Firefox, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a user's system.

1) The problem is that "IFRAME" JavaScript URLs are not properly protected from being executed in context of another URL in the history list. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

2) Input passed to the "IconURL" parameter in "InstallTrigger.install()" is not properly verified before being used. This can be exploited to execute arbitrary JavaScript code with escalated privileges via a specially crafted JavaScript URL.

Successful exploitation requires that the site is allowed to install software (default sites are "update.mozilla.org" and "addons.mozilla.org").

[KissMyAsscroft]

1. How do you fix it?

I use that browser but I can't figure out how to disable Javascript. What are the possible problems?

[Crazy Guggenheim]

3. Just go here.

update.mozilla.org

Make sure there is the http:\\ in front of it.

[hlthe2b]

2. I disabled javascript...

(tools, options, web features--uncheck "enable javascript")

Is that all I need to do? Java can be enabled, but not javascript?

[cprise]

4. Um, you would have already had to install the sites software to begin with

So if the malicious site wanted to betray your trust, they already have more direct ways to harm you than running JavaScript in an IFRAME. What's important is that nothing gets installed without you knowing it.

It is great that Mozilla is going after even relatively minor security issues, but lets not blow these problems out of proportion.

[BigMcLargehuge]

5. goodness me, I guess I'll run back to using the ultra secure IE now

thanks for the paranoia

[havocmom]

6. yeah, me too... NOT

:rofl: