David Lawrence

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote attackers to execute arbitrary Javascript in other domains. This is achieved by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution. Recommendations: For Firefox version 1.0.3, update to a newer version to mitigate the risk.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote web sites on the browser's whitelist to execute arbitrary Javascript with chrome privileges. This can lead to arbitrary code execution on the system when combined with other vulnerabilities. The exploitation can be demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site. Recommendations: For Firefox version 1.0.3, consider restricting access to the `install` function until a patch is available. As a temporary workaround, avoid using the `javascript:` URL scheme for package icons to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** gnome-vfs versions 1.0.1 gnome-vfs-devel version 1.0.1 gnome-vfs2 (affected versions not specified) grip version 3.1.2 **Description** The issue allows for remote exploitation, potentially leading to a breach of confidentiality, integrity, and availability of protected information. It involves a buffer overflow in discdb.c for grip, which can cause a denial of service and possibly execute arbitrary code by returning more matches than expected during the cddb lookup. **Recommendations** For gnome-vfs versions 1.0.1, update to a version that includes the necessary security patches. For gnome-vfs-devel version 1.0.1, apply the relevant security fixes to prevent exploitation. For gnome-vfs2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For grip version 3.1.2, consider disabling the cddb lookup functionality until a patch is available to prevent potential code execution.