Bugtraq mailing list archives
Unpatched input validation flaw in Firefox 2.0.0.4
From: "Thor Larholm" <larholm () gmail com>
Date: Mon, 4 Jun 2007 21:42:05 +0200
Firefox 2.0.0.4 contains a fix for a directory traversal vulnerability that allowed you to read local files through the resource protocol. However, the patch only partially fixed the vulnerability on Windows systems and accidentally circumvents an existing input validation check. The net result is that you can still read some local files on Windows and all user accessible files on Linux/Unix/OS X, with all user accessible files potentially readable as well on Windows through the patch regression. http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004/ Cheers Thor Larholm
Current thread:
- Unpatched input validation flaw in Firefox 2.0.0.4 Thor Larholm (Jun 04)