Slashdot is powered by your submissions, so send in your scoop


Forgot your password?

Submission + - 2 JavaScript holes (with exploits) this week

An anonymous reader writes: Double strike this week for Michal Zalewski, who published JavaScript based exploits for two new web browser vulnerabilities. The one disclosed on Monday allows attacker to read sensitive local files on your computer without your explicit permission, and affects both IE 7 and Firefox The other one allows malicious websites to manipulate authentication cookies for third-party sites, and to possibly do other nasty things as well. A patch for the latter bug, notified to Mozilla on Wednesday, has already been developed and will likely be available in a security upgrade. Obviously enough, users of the NoScript Firefox extension are immune from both these attack vectors.

"Experience has proved that some people indeed know everything." -- Russell Baker