Nice to see advisory from Zerodium 
Advisory: Tor Browser 7.x has a serious vuln/bugdoor leading to full bypass of Tor / NoScript 'Safest' security level (supposed to block all JS). PoC: Set the Content-Type of your html/js page to "text/html;/json" and enjoy full JS pwnage. Newly released Tor 8.x is Not affected.
-
-
Thanks. Twitter will use this info to make your timeline better. UndoUndo
-
-
-
do yall release advisories for all your acquired 'sploits that have reached their "pwn-by-date"?
Thanks. Twitter will use this info to make your timeline better. UndoUndo
-
-
-
Concise and neat. Love exploits that fit in a tweet.
Thanks. Twitter will use this info to make your timeline better. UndoUndo
-
-
-
Are we supposed to give you a bounty ? ;p
Thanks. Twitter will use this info to make your timeline better. UndoUndo
-
-
-
what will be the impact of this vulnerability on an average user like me ???
-
well an average user like you must update his tor browser.. and done
- Show replies
New conversation -
-
-
This Tweet is unavailable.
-
It’s a bug in the NoScript addon, not Firefox itself. TorBrowser bundles NoScript.
End of conversation
-
-
-
Fixed in 5.1.8.7 "Classic": https://noscript.net/getit#classic You may need to open about:config and set your xpinstall.signatures.required to false in order to install, since
@mozilla's@mozamo doesn't support signatures for legacy add-ons anymore. cc:@torproject ,@campuscodi -
When is somebody going to start a
#ForkofFirefox based on#Torbrowser but with the "classic" add-on API enabled since that was the only thing that set it apart from#GoogleChrome? Is it just an impression that@mozilla business choices are always in favor of Google? - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.