Tech | kanenas.net | Web Applications, Crafted with Care

Fixed in Firefox 3.0.11 (several security issues)

Posted on 12/06/2009 (15/04/2018) by Nikolas

We strongly recommend the update to Firefox 3.0.11.

Firefox 3.0.11 fixes several security issues found in Firefox 3.0.10 (4 Critical, 1 High, 2 Moderate, 2 Low):

MFSA 2009-32 JavaScript chrome privilege escalation
MFSA 2009-31 XUL scripts bypass content-policy checks
MFSA 2009-30 Incorrect principal set for file: resources loaded via location bar
MFSA 2009-29 Arbitrary code execution using event listeners attached to an element whose owner document is null
MFSA 2009-28 Race condition while accessing the private data of a NPObject JS wrapper class object
MFSA 2009-27 SSL tampering via non-200 responses to proxy CONNECT requests
MFSA 2009-26 Arbitrary domain cookie access by local file: resources
MFSA 2009-25 URL spoofing with invalid unicode characters
MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)

The sooner… the safer!

😉 […]

The Open Web Application Security Project (OWASP)

Posted on 17/05/2009 (15/04/2018) by Nikolas

The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work with your support. […]

Crash in nsTextFrame::ClearTextRun() – Firefox 3.0.9

Posted on 28/04/2009 (15/04/2018) by Nikolas

Mozilla Foundation Security Advisory 2009-23

Title: Crash in nsTextFrame::ClearTextRun()
Impact: Critical
Announced: April 27, 2009
Reporter: Marc Gueury, Daniel Veditz
Fixed in: Firefox 3.0.10

Description
One of the security fixes in Firefox 3.0.9 introduced a regression that caused some users to experience frequent crashes. Users of the HTML Validator add-on were particularly affected, but other users also experienced this crash in some situations. In analyzing this crash we discovered that it was due to memory corruption similar to cases that have been identified as security vulnerabilities in the past. […]