Firefox Update Fixes Security Flaws
Mozilla has rolled out an incremental upgrade for Firefox 2 that fixes three security vulnerabilities, all of which are rated as “high.”
Firefox 2.0.0.10 patches a highly publicized jar protocol flaw that allows cross site scripting attacks. The fix changes the way the Firefox handles the loading of jar: protocol URIs. The security advisory reads:
URI scheme has been restricted to files served with a Content-Type header of application/java-archive or application/x-jar. Web applications that require signed pages must make sure their .jar archives are served with this Content-Type. Sites that allow users to upload binary files should make sure they do not allow these files to have one of these two MIME types.
Another vulnerability addressed also involves a cross site scripting vulnerability, fixing a an error in the way Firefox handles JavaScript initiated window contents changes.
The upgrades are recommended for all Firefox users and can be found via the “check for updates” menu item in Firefox, or downloaded directly from the Mozilla site.
See Also:
