Firefox versions 1.0.1 and 1.0.2 contain the vulnerability, the security information company said in an advisory on Monday. The flaw stems from an error in the JavaScript engine that can expose arbitrary amounts of heap memory after the end of a JavaScript string. As a result, an exploit may disclose sensitive information in the memory, Secunia said.

\"Unlike other browser flaws, this one is not subject to phishing or access to the system. But it can expose sensitive information from other Web sites you visited and the information you entered there,\" said Thomas Kristensen, Secunia chief technology officer.

While the flaw is only rated as \"moderately critical\" by Secunia, the rapid adoption of the open-source browser means that many users may be at risk. Prior to the release of version 1.0, downloads of earlier versions of the browser had reached 8 million within the first 18 months.

The Mozilla Foundation, which makes the Firefox browser, is working on a patch, and no cases have been reported, a representative for the group said.

Secunia has developed a test that allows people to see whether their system is affected by the vulnerability.



[Edited on 4/7/2005 by Mega X.exe]

It can be fixed for a while if people turn java script off until it\'s patched.

(I tested this myself using the test and having turned java off)

*boots this topic back up*

Patch is out now for Firefox! Just letting you guys know this. =P If anyone screams double post at me, I\'ll hurt them. ;_;

cool.....thats vary cool man

Where? I can\'t seem to find it anywhere on http://www.mozilla.org/firefox

[Edited on 19/4/05 by Indifferent Protester]

Version 1.0.3 has that patch in it. Just update to that.

[quote]Originally posted by Indifferent Protester

Where? I can\'t seem to find it anywhere on http://www.mozilla.org/firefox

[Edited on 19/4/05 by Indifferent Protester] [/quote]

It\'s RIGHT THERE. Read carefully!

Free Download
Firefox 1.0.3 for Windows, English (4.7MB)
Other Systems and Languages

It\'s been updated since I posted the link.

Odd. I\'ve not come up with an update automatically. I\'ll check manually.

Weired. I had to install and download from the site: it wouldn\'t notice that there was an update.

[Edited on 20/4/05 by Indifferent Protester]