Mozilla's URL-handling hassles began earlier in July, when security researcher Thor Larholm found a zero-day vulnerability that can lead to systems getting hijacked. Larholm called it an IE zero-day at the time, blaming the vulnerability on an input validation flaw in Internet Explorer that allows users to specify arbitrary arguments to the process responsible for handling URL protocols. It's the same type of input validation vulnerability that Larholm discovered in the Safari 3 beta, he said at the time.
The vulnerability involved IE as an entry point and Firefox as the application receiving bad data. There ensued much passing of the buck following this earlier URL-handling flaw, with Microsoft blaming Firefox and Mozilla blaming IE and much the blogosphere doing its part in the blame game.
Mozilla Security Chief Window Snyder owned up to the issue on July 23, though, saying that Mozilla had found a new scenario over the weekend in which Firefox could be used as an attack entry point in various ways. Specifically, while browsing with Firefox, Snyder said, a malicious URL could be used to pass along bad data to another application.
Read the rest of this story at eWEEK: "Firefox Under the Gun of Yet Another URL-Handling Bug"