Secunia

Paul has discovered a vulnerability in Mozilla Firefox, which can be exploited by malicious people to conduct cross-site scripting attacks.

The vulnerability is caused due to missing URI handler validation when dragging an image with a "javascript:" URL to the address bar of another window. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site by tricking a user into dragging an image to the address bar.

This is similar to vulnerability 2 in:
SA14160

The vulnerability has been confirmed in versions 1.0.4 and 1.0.7, and has also been reported in versions 1.0 and 1.0.1. Other versions may also be affected.

Solution
Update to version 1.5.
Further details available in Customer Area

Provided and/or discovered by
Paul (greyhats)

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area