A vulnerability has been reported in the Yoono extension for Firefox, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to DOM event handlers being evaluated within the "chrome:" context. This can be exploited to e.g. execute arbitrary commands on a user's system when a user invokes the extension on a specially crafted web page.

The vulnerability is reported in versions prior to 6.1.1.

Solution
Update to version 6.1.1 or later.

Provided and/or discovered by
Roberto Suggi Liverani and Nick Freeman

Changelog
Further details available to Secunia VIM customers

Original Advisory
Yoono:
https://addons.mozilla.org/en-US/firefox/addons/versions/1833#version-6.1.1

Nick Freeman:
http://security-assessment.com/files/advisories/Yoono_Firefox_Extension_Privileged_Code_Injection.pdf

Deep Links
Links available to Secunia VIM customers