Re: Does it ever make sense that a web page can have chrome privs?

2010-02-23 Thread Daniel Veditz
On 2/23/10 6:15 PM, Boris Zbarsky wrote: > On 2/23/10 8:14 PM, Natch wrote: >> I was thinking (in bug 491243) that channels shouldn't inherit chrome >> privileges ever unless they are data, javascript or chrome channels >> (or that sort). > > That's already the case. The documents can end up priv

Re: MFSA 2010-03 exploitable with disabled Javascript?

2010-02-23 Thread Daniel Veditz
On 2/21/10 10:45 PM, Manuel Reimer wrote: > my distributor, so far, didn't publish an updated package, so I'll have > to keep with an old Firefox for some days. > > For all of the current holes, disabling Javascript seems to be OK for > the meantime, according to your advisories, so I did so. > >

Re: Does it ever make sense that a web page can have chrome privs?

2010-02-23 Thread Boris Zbarsky
On 2/23/10 8:14 PM, Natch wrote: I was thinking (in bug 491243) that channels shouldn't inherit chrome privileges ever unless they are data, javascript or chrome channels (or that sort). That's already the case. For example, it is possible for any web site to run in an elevated context(and do

Does it ever make sense that a web page can have chrome privs?

2010-02-23 Thread Natch
I was thinking (in bug 491243) that channels shouldn't inherit chrome privileges ever unless they are data, javascript or chrome channels (or that sort). For example, it is possible for any web site to run in an elevated context(and do practically anything to the user's computer) if you type the f

Re: Fix for the TLS renegotiation bug

2010-02-23 Thread Kai Engert
On 23.02.2010 02:21, Jan Schejbal wrote: Hi, Test server at https://ssltls.de none of the two images is visible with my Fx3.6. I don't give any guarantees about my prefs and addons, though. Jan Firefox 3.6 does not yet have any fixes for this. As of today, only the experimental nightly b

Re: Fix for the TLS renegotiation bug

2010-02-23 Thread Kai Engert
On 23.02.2010 02:21, Jan Schejbal wrote: Hi, Test server at https://ssltls.de none of the two images is visible with my Fx3.6. I don't give any guarantees about my prefs and addons, though. Jan Firefox 3.6 does not yet have any fixes for this. As of today, only the experimental nightly b