Mozilla Foundation Security Advisory 2011-59
.jar not treated as executable in Firefox 3.6 on Mac
- Announced
- December 20, 2011
- Impact
- Critical
- Products
- Firefox, Thunderbird
- Fixed in
-
- Firefox 3.6.25
- Thunderbird 3.1.17
Description
Part of the fix for
MFSA 2011-40, reported by Mariusz Mlynski, was to treat .jar
files as executables. This is necessary because Java treats downloaded .jar
files as fully-featured "Applications" rather than restricting them to the
limited privileges of in-browser "Applets". The fix taken in Firefox 3.6
was discovered to be incorrect for the Mac OS X version.