We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Firefox 2.0 users get cross-scripting fix

Handful of bugs squashed in Mozilla update

Firefox users have been given a new security update which fixes a widely publicised flaw in the open-source browser.

Mozilla's 2.0.0.10 update fixes a handful of memory corruption flaws that crash Firefox, and a cross-site request forgery flaw that could give attackers a way to get unauthorised access to certain websites.

But the most anticipated bug fix in this release addresses a problem in the way Firefox processes files that are compressed using the Java Archive (.jar) format.

Firefox does not properly check .jar files, giving attackers a way to launch web-based cross-site-scripting attacks against Firefox users. The bug was first reported in February, but it gained widespread attention in early November when security researchers showed how it could be used in cross-site scripting attacks to run unauthorised code on the victim's PC.

The memory corruption bugs could also have led to more serious problems, Mozilla said in its note on the bugs. "We presume that with enough effort, at least some of these could be exploited to run arbitrary code," the note reads.

This .jar flaw is one of a new category of bugs that have popped up in Firefox and other browsers in recent months. They have to do with the way the browser handles special web links that are used to launch applications. Known as Uniform Resource Identifier (URI) protocol handler vulnerabilities, these bugs can be triggered when software is launched via the browser.

URI protocol handler flaws have been found in Microsoft Internet Explorer, Adobe software and Google's Picasa software.

For more security news, reviews and tutorials, see Security Advisor


IDG UK Sites

LG G4 review: Great price and camera but misses the mark in other areas

IDG UK Sites

Why Scottish Tablet is better than the iPad mini

IDG UK Sites

How to develop for Microsoft's HoloLens

IDG UK Sites

Apple MacBook 1.1 GHz review (Retina, 12-inch, Early 2015): The future of Apple laptops