Mozilla Browsers Could Allow Execution of Arbitrary Code

Reported May 8, 2005 by Paul of Greyhats Security Group


Mozilla Suite


The Mozilla Suite and Firefox browsers might allow the execution of arbitrary code if Javascript is enabled in the browser. An attacker could inject javascript into a Web site by causing the browser to navigate to a previous javascript URL. Or, an attacker could use the browsers' install confirmation dialog to execute code by using javascript as a package icon.


Mozilla Foundation is aware of the problems and has made changes to its Mozilla Update Web service to help mitigate risks. The Foundation said it is "aggressively working to provide a more comprehensive solution to these potential vulnerabilities and will provide that solution in a forthcoming security update. Users can further protect themselves today by temporarily disabling JavaScript."

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.