Firefox version 2.0.0.5 has now been released to help squash some security bugs that have been ferreted out of the browser.
From Secunia:
Description:
Some vulnerabilities have been reported in Mozilla Firefox, which can be exploited by malicious people to conduct spoofing and cross-site scripting attacks and potentially to compromise a user’s system.1) Various errors in the browser engine can be exploited to cause memory corruption and potentially to execute arbitrary code.
2) Various errors in the Javascript engine can be exploited to cause memory corruption and potentially to execute arbitrary code.
3) An error in the “addEventListener” and “setTimeout” methods can be exploited to inject script into another site’s context, circumventing the browser’s same-origin policy.
4) An error in the cross-domain handling can be exploited to inject arbitrary HTML and script code in a sub-frame of another web site.
This is related to vulnerability #5 in:
SA219065) An unspecified error in the handling of elements outside of documents allows an attacker to call an event handler and execute arbitrary code with chrome privileges.
6) An unspecified error in the handling of “XPCNativeWrapper” can lead to execution of user-supplied code.
Patchy, patchy (a la Bart Simpson)
Tags: Firefox 2.0.0.5, Firefox Bugs, Firefox Vulnerabilities
