We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Firefox 2.0 users get cross-scripting fix

Handful of bugs squashed in Mozilla update

Firefox users have been given a new security update which fixes a widely publicised flaw in the open-source browser.

Mozilla's 2.0.0.10 update fixes a handful of memory corruption flaws that crash Firefox, and a cross-site request forgery flaw that could give attackers a way to get unauthorised access to certain websites.

But the most anticipated bug fix in this release addresses a problem in the way Firefox processes files that are compressed using the Java Archive (.jar) format.

Firefox does not properly check .jar files, giving attackers a way to launch web-based cross-site-scripting attacks against Firefox users. The bug was first reported in February, but it gained widespread attention in early November when security researchers showed how it could be used in cross-site scripting attacks to run unauthorised code on the victim's PC.

The memory corruption bugs could also have led to more serious problems, Mozilla said in its note on the bugs. "We presume that with enough effort, at least some of these could be exploited to run arbitrary code," the note reads.

This .jar flaw is one of a new category of bugs that have popped up in Firefox and other browsers in recent months. They have to do with the way the browser handles special web links that are used to launch applications. Known as Uniform Resource Identifier (URI) protocol handler vulnerabilities, these bugs can be triggered when software is launched via the browser.

URI protocol handler flaws have been found in Microsoft Internet Explorer, Adobe software and Google's Picasa software.

For more security news, reviews and tutorials, see Security Advisor


IDG UK Sites

Best Black Friday 2014 tech deals: Get bargains on smartphones, tablets, laptops and more

IDG UK Sites

What the Internet of Things will look like in 2015: homes will get smarter, people might get fitter

IDG UK Sites

See how Trunk's animated ad helped Ade Edmondson plug The Car Buying Service

IDG UK Sites

Yosemite tips: Complete Guide to OS X Yosemite