Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.
Mozilla Firefox v3.6 anterior a v3.6.2 no ofrece a las extensiones el mecanismo de protección window.location, lo que permite a atacantes remotos evitar la política de "Same Origin" y dirigir ataques de secuencias de comandos en sitios cruzados (XSS) a traves de vectores que son específicos para cada plugin afectado.
Many security issues have been identified and fixed in Firefox. These range from various memory consumption issues to denial of service vulnerabilities. Since firefox-3.0.19 is the last 3.0.x release Mandriva opted to provide the latest 3.6.3 version for Mandriva Linux 2008.0/2009.0/2009.1/MES5/2010.0. Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products. Additionally, some packages which require so, have been rebuilt and are being provided as updates. Packages for 2009.0 are provided due to the Extended Maintenance Program.
