Firefox Bug

[Ice Czar]

An exploit that appeared on Bugzilla last week is the focus of a Symantec warning.

"It does appear that triggering the vulnerability using the proof of concept results in the execution of data somewhere in anonymous memory, possibly in a portion of the heap," Symantec told customers of its DeepSight threat alert system Tuesday. "If this memory were somehow populated by an attacker with a malicious payload, this condition could likely be exploited to execute arbitrary code."

Secunia has given it a low warning, however that is based on it just crashing the browser not the potential subversion mentioned by Symantec. In either event it's a malformed Javascript exploit and simply employing the noscript extension and a little judgement in who gets to run scripts on your box will likely see you through till a patch is released.

View at TechPowerUp Main Site