Mozilla Foundation Security Advisory 2011-59

.jar not treated as executable in Firefox 3.6 on Mac

Announced
December 20, 2011
Impact
Critical
Products
Firefox, Thunderbird
Fixed in
  • Firefox 3.6.25
  • Thunderbird 3.1.17

Description

Part of the fix for MFSA 2011-40, reported by Mariusz Mlynski, was to treat .jar files as executables. This is necessary because Java treats downloaded .jar files as fully-featured "Applications" rather than restricting them to the limited privileges of in-browser "Applets". The fix taken in Firefox 3.6 was discovered to be incorrect for the Mac OS X version.

References