Firefox 2.0.0.10 Is Here
November 28, 2007
Firefox 2.0.0.10 is now released and fixes a total of 3 security vulnerabilities.
Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks… Read more
The jar: URI scheme was introduced as a mechanism to support digitally signed web pages, enabling web sites to load pages packaged in zip archives containing signatures in java-archive format.
Jesse Ruderman and Petko D. Petkov point out this means that sites that allow users to upload binary content in zip format are effectively allowing users to install web pages on their site, and these can be used to perform Cross-Site Scripting (XSS) attacks… Read more
Don’t miss the news. Subscribe to our RSS Feed.
Be the first to know. Subscribe to our RSS Feed 

















[…] Home Page « Firefox 2.0.0.10 Is Here […]
[…] “Firefox 2.0.0.10 Is Here” topic for the […]