Mark Pilgrim has reported a vulnerability in the Greasemonkey extension for Firefox, which can be exploited by malicious people to disclose various information.

The vulnerability is caused due to certain functions being insecurely exposed and can be exploited by a malicious web site via e.g. the "GM_xmlhttpRequest()" function to disclose the contents of arbitrary local files and list the contents of arbitrary local directories.

Successful exploitation requires that a Greasemonkey script is configured to run on the malicious web site.

The vulnerability has been reported in versions prior to 0.3.5.

Solution
The vulnerability has been fixed in version 0.3.5 by reducing the functionality.

Provided and/or discovered by
Mark Pilgrim

Original Advisory
http://greaseblog.blogspot.com/2005/07/mandatory-greasemonkey-update.html

Deep Links
Links available to Secunia VIM customers