Red Hat Bugzilla – Bug 151494
CAN-2004-0906 Mozilla XPI installer insecure file creation
Last modified: 2007-11-30 17:07:06 EST
The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla
before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain
installed files within xpi packages, which could allow local users to overwrite
arbitrary files or execute arbitrary code.
This issue also affects RHEL2.1
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.