Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: Thor Larholm <larholm <at> gmail.com>
Subject: Unpatched input validation flaw in Firefox 2.0.0.4
Newsgroups: gmane.comp.security.bugtraq
Date: Monday 4th June 2007 19:42:05 UTC (over 10 years ago)
Firefox 2.0.0.4 contains a fix for a directory traversal vulnerability
that allowed you to read local files through the resource protocol.

However, the patch only partially fixed the vulnerability on Windows
systems and accidentally circumvents an existing input validation
check.

The net result is that you can still read some local files on Windows
and all user accessible files on Linux/Unix/OS X, with all user
accessible files potentially readable as well on Windows through the
patch regression.

http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004/

Cheers

Thor Larholm
 
CD: 3ms