Mozilla 1.4 Security Update Advisory
Results 1 to 4 of 4

Thread: Mozilla 1.4 Security Update Advisory

  1. #1
    AO French Antique News Whore
    Join Date
    Aug 2001
    Posts
    2,126

    Mozilla 1.4 Security Update Advisory

    A number of vulnerabilities were discovered in Mozilla 1.4:

    A malicious website could gain access to a user's authentication credentials to a proxy server.

    Script.prototype.freeze/thaw could allow an attacker to run arbitrary code on your computer.

    A vulnerability was also discovered in the NSS security suite which ships with Mozilla. The S/MIME implementation would allow remote attackers to cause a Denial of Service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs, which was demonstrated using the NISCC test suite. NSS version 3.9 corrects these problems and has been included in this package (which shipped with NSS 3.8).

    Finally, Corsaire discovered that a number of HTTP user agents contained a flaw in how they handle cookies. This flaw could allow an attacker to avoid the path restrictions specified by a cookie's originator. According to their advisory:

    "The cookie specifications detail a path argument that can be used to restrict the areas of a host that will be exposed to a cookie. By using standard traversal techniques this functionality can be subverted, potentially exposing the cookie to scrutiny and use in further attacks."

    As well, a bug with Mozilla and Finnish keyboards has been corrected.
    More Info : http://www.securityfocus.com/advisories/6437
    Original Advisories : http://www.mandrakesecure.net/en/adv...MDKSA-2004:021 (Down Right Now)
    -Simon \"SDK\"

  2. #2
    Junior Member
    Join Date
    Mar 2004
    Posts
    4
    Have you any idea if this has been fixed in Mozilla 1.6?
    It is an Honor to Serve, that one day may arrive where no man will be with out excuse that he has not heard the Name of Christ proclaimed.

  3. #3
    AO French Antique News Whore
    Join Date
    Aug 2001
    Posts
    2,126
    I think it was. Not sure complety sure.
    -Simon \"SDK\"

  4. #4
    Junior Member
    Join Date
    Feb 2004
    Posts
    10
    If you have 1.4.2 or 1.5.0 or anything newer it has been fixed. Just goes to show how good the open source community can be about fixing bugs. This is just getting posted here but it was fixed a couple months ago.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •