Reported May 8, 2005 by Paul of Greyhats Security Group
VERSIONS AFFECTED
|
Firefox
Mozilla Suite
|
DESCRIPTION
The Mozilla Suite and
Firefox browsers might allow the execution of arbitrary code if
Javascript is enabled in the browser. An attacker could inject
javascript into a Web site by causing the browser to navigate to a
previous javascript URL. Or, an attacker could use the browsers'
install confirmation dialog to execute code by using javascript as a
package icon.
VENDOR RESPONSE
Mozilla Foundation is
aware of the problems and has made changes to its Mozilla Update Web
service to help mitigate risks. The Foundation said it is "aggressively
working to provide a more comprehensive solution to these potential
vulnerabilities and will provide that solution in a forthcoming
security update. Users can further protect themselves today by
temporarily disabling JavaScript."
