Tech~Covo

Opera 9.63 is a recommended security and stability upgrade.

Opera 9.63 incorporates the Opera Presto 2.1.1 user agent engine.

[cut]

security fixes
[code] * Manipulating text input contents can allow execution of arbitrary code, as reported by Red XIII. See our advisory.
* HTML parsing flaw can cause Opera to execute arbitrary code, as reported by Alexios Fakos. See our advisory.
* Long hostnames in file: URLs can cause execution of arbitrary code, as reported by Vitaly McLain. see our advisory.
* Script injection in feed preview can reveal contents of unrelated news feeds, as reported by David Bloom. See our advisory.
* Built-in XSLT templates can allow cross-site scripting, as reported by Robert ...

MFSA 2008-69 XSS vulnerabilities in SessionStore

Mozilla security researcher moz_bug_r_a4 reported vulnerabilities in the session-restore feature by which content could be injected into an incorrect document storage location, including storage locations for other domains. An attacker could utilize these issues to violate the browser's same-origin policy and perform an XSS attack while SessionStore data is being restored.

moz_bug_r_a4 also reported that one variant could be used by an attacker to run arbitrary JavaScript with chrome privileges.

[url=http://www.mozilla.org/security/announce/2008/mfsa2008-68.html]MFSA 2008-68[...

Maybe somepeople remembered that old gallery here was developed by smartor (smartor.is-root), a known phpBB2 MODder from Vietnam.

The new domain owner wrote:Smartor himself seems to have dropped any phpBB2 Development and the Domain was down for nearly one year now and all old Forum Content seems to have lost.

The new site server is in Germany.

And btw ... the old smartor site was IIRC hosted on his own PC. Then it happened what it happened: site down from eons and no more support for smartor MODs on smartor site (where btw I had a registered account).

F was unleashed on November 12th.

Fixes from FF 3.0.3
Stat: 4 critical, 2 high, 2 moderate, 1 low.

Upgrading is highly recommended.
Disabling javascript in Mozilla Thunderbird too, at least until a new version comes out

• MFSA 2008-58 Parsing error in E4X default namespace
• MFSA 2008-57 -moz-binding property bypasses security checks on codebase principals
• MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation
• MFSA 2008-55 Crash and remote code execution in nsFrameManager
  ling and wushi of team509, via TippingPoint's Ze...

First the good news: no security related issues found in v 3.0.2

According to the release notes, it was born only to fix a non working password management system

Let's see

bug reporter wrote:My preferences are set to REMEMBER PASSWORDS FOR SITES and there are
no exceptions in the EXCEPTIONS box.

Reproducible: Always

Steps to Reproduce:
1.I type user name and password for any site, paypal, wachovia, etc.
2. It takes me to the logged in site without asking if I want the password
remembered.
3.
Actual Results:
It happens at every site that requires a password.

The upgrade file...

It has been released today . Let's see

# Fixed several security issues.
# Fixed several stability issues.
# Official releases for Sinhala and Slovene are now available.
# Beta releases for Bengali, Galician, Hindi, Icelandic, Kannada, Marathi, Telegu, and Thai are available for testing.
# Fixed a number of minor issues with the layout of certain web pages.
# Fixed several theme issues that affected right-to-left locales.
# Fixed issue that caused some users with customized toolbars to have their Back and Forward buttons go missing (bug 426026)
# Add new Extended Validation (EV) roots to Firefox 3.0.2.
# On certain IDN sites, the password manager would not fill in username and password details properly.
# Fixed several hangs and crashes that occurred when using screen readers.
# Fixed Mac...

If you were roaming for enough time after Olympus stuff, you may have found at least once in your life this address:

http://olympuswiki.naderman.de

It was linked through startrekguide and not only. Basically, all database table stuff was there, and it was very useful if you had some low level actions to do or some tricks to spot. The project was then moved to another address that I don't remember. And then, yesterday late night ...

Acyd Burn, here wrote:I am pleased to announce the addition of a w...

Last edited by Juanm on Friday September 5th, 2008 13h40:14, edited 3 times in total.
Reason: adjusted formatting

Read full news: Here
Link to topic: phpBB dev wiki on phpbb.com
Comments: 1