Security boff finds holes in IE and Firefox

A BOFFIN specialising in security called Michael Zalewski has discovered four more zero-day vulnerabilities in Microsoft and Mozilla's browsers.

The most serious is an IE6 and IE7 flaw Zalewski said is "critical." IE gives hackers the ability to run malicious Javascript to hijack the PC. That's your PC, chum.

Up-to-date versions of IE6 and IE7 are at risk, although Firefox is not.

However Firebadger has a IFrame vulnerability in Firefox 2.0 can let attackers plant keyloggers or drop malicious content into a legitimate web site. It is similar to a flaw discovered last year which was patched. Zalewski claims that Mozilla hadn't plugged all the holes.

Zalewski posted information about two other bugs, both rated "medium." So far none of the holes seem to have been exploited.

More here. µ