Michal Zalewski has discovered a vulnerability in Mozilla Firefox, which can be exploited by malicious people to conduct spoofing attacks.

The vulnerability is caused due to the address bar of a newly opened window displaying the URL of the requested location before the page is loaded. This can be exploited to display arbitrary content in the blank document while showing the URL of a trusted web site in the address bar, e.g. by calling "window.stop()" to abort loading the new page.

The vulnerability is confirmed in version 3.6.4. Other versions may also be affected.

Solution
Update to version 3.5.11 and 3.6.7.

Provided and/or discovered by
Michal Zalewski

Changelog
Further details available to Secunia VIM customers

Original Advisory
Michal Zalewski:
http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html

Mozilla:
http://www.mozilla.org/security/announce/2010/mfsa2010-45.html

Deep Links
Links available to Secunia VIM customers