Language Selection

English French German Italian Portuguese Spanish

Mozilla Firefox Two Vulnerabilities

Filed under
Security

Classified Extremely critical, two vulnerabilities have been discovered in Firefox, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a user's system.

Description:
Two vulnerabilities have been discovered in Firefox, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a user's system.

1) The problem is that "IFRAME" JavaScript URLs are not properly protected from being executed in context of another URL in the history list. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.

2) Input passed to the "IconURL" parameter in "InstallTrigger.install()" is not properly verified before being used. This can be exploited to execute arbitrary JavaScript code with escalated privileges via a specially crafted JavaScript URL.

Successful exploitation requires that the site is allowed to install software (default sites are "update.mozilla.org" and "addons.mozilla.org").

A combination of vulnerability 1 and 2 can be exploited to execute arbitrary code.

NOTE: Exploit code is publicly available.

The vulnerabilities have been confirmed in version 1.0.3. Other versions may also be affected.

Solution:
Disable JavaScript.

Linkage.

More in Tux Machines

today's howtos

Leftovers: Gaming

Red Hat and Fedora

Canonical and Ubuntu

  • OpenStack Solution Provider Awnix Joins Canonical's Cloud Partner Programme
    Canonical has been excited to announce that Awnix, an OpenStack solution provider with over 25 years of experience designing systems for enterprise data center environments, has joined its Partner Reseller Programme for cloud solutions.
  • Docker Has No Plans to Ditch Ubuntu in Favor of Alpine Linux - Report
    If you've been reading the news lately, you may have heard rumors that Docker founders hired the developer of Alpine Linux, a small, text-based distribution, to move the official Docker images away from the Ubuntu infrastructure.
  • More Android Vendors Said To Be Eyeing Ubuntu Phones This Year
    A greater number of Android smartphone/tablet vendors are said to be eyeing Ubuntu Phone for new devices later this year. In an interview published this morning by The Register, Canonical CEO Jane Silber talked about their communications with more (unnamed) Android vendors and supposedly seeing some other vendors offering Ubuntu Phone products later in 2016.