Simon Willison’s Weblog

Critical Mac OS X Java Vulnerabilities. There’s a five month old Java arbitrary code execution vulnerability which hasn’t yet been patched by Apple. Disable Java applets in your browser until it’s fixed, or random web pages could execute commands on your machine as your user account.

# 19th May 2009, 7:07 pm / osx, security, java, applets, browsers, apple

Evil GIFs: Partial Same Origin Bypass with Hybrid Files. First there were PNGs that had crossdomain.xml files embedded in them, now there are GIFs that contain Java applets (as JAR files). At this point I’d say don’t even bother trying to validate uploaded files, just make sure they’re served off an entirely different domain instead where XSS doesn’t matter.

# 1st July 2008, 8:58 am / xss, security, validation, uploads, pngs, crossdomainxml, gifs, javaapplets, applets