[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] Tor security advisory: Old Tor Browser Bundles vulnerable

To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-talk] Tor security advisory: Old Tor Browser Bundles vulnerable
From: Lars Noodén <lars.nooden@xxxxxxxxx>
Date: Mon, 05 Aug 2013 19:02:26 +0300
Delivered-to: archiver@xxxxxxxx
Delivery-date: Mon, 05 Aug 2013 12:11:43 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=4CzbyKsGuVQA7nLhktqg07hYsdLsNxenZeaJ5h/9ou4=; b=B07V23zpP7Ve6ODkpODz02DBcDefGuyzHOxgqm7Ebn0SpfbLBAVI3q++V19rp4b33B ZfREcFMOU9mFtZejTrcq6AQ6ZlycwtndloxEmJmOaL+dRaKpyS/6wGvo6AkWRf5wFInZ mTnUzfVH94fAxifQU+R4V6lGcWZgr0McVMJqU9I6jZTB1g8KUQuIYys5RM23r1L4VfV7 KzYJKFEQJHlj+76vxqRzu0J1wYp69moNEcyFtueZmlmW+iTeM70+lTzFbmJJN9yWLwk8 XXzIqwVu5HccXkcM2FPEkBp774QGdADkRiSPdkI7sIobczkiNeGs+4/L/Xkn7IcI5+W/ MnBw==
In-reply-to: <20130805151312.GF6713@xxxxxxxxxxxxxx>
List-archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-id: "all discussion about theory, design, and development of Onion Routing" <tor-talk.lists.torproject.org>
List-post: <mailto:tor-talk@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
References: <20130805151312.GF6713@xxxxxxxxxxxxxx>
Reply-to: tor-talk@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-talk" <tor-talk-bounces@xxxxxxxxxxxxxxxxxxxx>
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130623 Thunderbird/17.0.7

On 08/05/2013 06:13 PM, Roger Dingledine wrote:
>   And finally, be aware that many other vectors remain for vulnerabilities
>   in Firefox. JavaScript is one big vector for attack, but many other
>   big vectors exist, like css, svg, xml, the renderer, etc.

If I understand it is possible to embed scripts inside SVG and the
decision currently is either to display SVG with any scripts it might
have or else not display any SVG at all.  It would be great to be able
to use SVG but with the possibility of embedded scripts turned off.

Regards,
/Lars
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsusbscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

References:
- [tor-talk] Tor security advisory: Old Tor Browser Bundles vulnerable
  - From: Roger Dingledine

Prev by Author: [tor-talk] Fwd: TBB browser without Tor/Vidalia
Next by Author: [tor-talk] log heartbeat update on demand?
Previous by thread: [tor-talk] Tor security advisory: Old Tor Browser Bundles vulnerable
Next by thread: Re: [tor-talk] Tor security advisory: Old Tor Browser Bundles vulnerable
Index(es):
- Author
- Thread