Security Alert: Greasemonkey

Well, it appears as if one of the more useful Firefox extensions is experiencing some security related woes. The fine folks working on Greasemonkey are calling for users to either patch their version or uninstall it immediately. They state:

The flaw allows any website which matches at least one user script (even * scripts) to read any local file on your machine, or to list the contents of local directories. The flaw applies to Greasemonkey on all platforms.

I’m working feverishly on a fix for this. But this will take several days. In the meantime, I strongly recommend that everyone either install Greasemonkey 0.3.5, or else disable or uninstall Greasemonkey completely.

Greasemonkey 0.3.5 is a “neutered” version of Greasemonkey, lacking any of the GM* APIs which make Greasemonkey scripts more powerful than regular HTML. This means that scripts which depend on GM* APIs will fail with Greasemonkey 0.3.5.

So, heed their advice and either patch your Greasemonkey install or drop it until the security issues are fully resolved.





Creative Commons Attribution-NonCommercial-ShareAlike 3.0 United States
Creative Commons Attribution-NonCommercial-ShareAlike 3.0 United States