Thursday, January 31, 2008 9:44 AM
cmosby
Mozilla Security Blog » Blog Archives » Status update for Chrome Protocol Directory Traversal issue
29 January 2008 Background on this issue is available here.
Impact
An attacker can use this vulnerability to collect session information, including session cookies and session history. Firefox is not vulnerable by default. Only users that have installed “flat” packed add-ons are at risk. Discussion about “flat” packaged add-ons is here. A partial list of “flat” packed add-ons is available here. If you are an author of any of these add-ons, please release an update to your add-on that uses .jar packaging.
This bug is tracking the additional information: https://bugzilla.mozilla.org/show_bug.cgi?id=413451
Status
Based on this new information Mozilla has changed the security severity rating to high. A fix is included in Firefox 2.0.0.12 which be available shortly.