wraggster
November 20th, 2009, 19:18
Researchers have found several security holes in popular Firefox extensions that have an estimated total of 30 million downloads from AMO (the Addons Mozilla community site). Three 0-days were also released. Mozilla doesn't have a security model for extensions and Firefox fully trusts the code of the extensions. There are no security boundaries between extensions and, to make things even worse, an extension can silently modify another extension."
The affected extensions are Sage version 1.4.3, InfoRSS 1.1.4.2, and Yoono 6.1.1 (and earlier versions). Clearly the problem is larger than just these three extensions
http://it.slashdot.org/story/09/11/20/1257232/Zero-Day-Vulnerabilities-In-Firefox-Extensions
The affected extensions are Sage version 1.4.3, InfoRSS 1.1.4.2, and Yoono 6.1.1 (and earlier versions). Clearly the problem is larger than just these three extensions
http://it.slashdot.org/story/09/11/20/1257232/Zero-Day-Vulnerabilities-In-Firefox-Extensions