Recently, two dangerous unpatched Javascript flaws have been found. Furthermore, the unpatched extremely critical security holes and exploit code has already been circulating on the Internet, according to sources.

The exploit, discovered by Paul of Greyhats Security Group and Michael “mikx” Krax, makes use of two separate vulnerabilities. An attacker could create a malicious page using frames and a JavaScript history flaw to make software installations appear to be coming from a “trusted” site. By default, Firefox allows software installations from update.mozilla.org and addons.mozilla.org, but users can add their own sites to this whitelist.

Mozilla Foundation confirmed that users may be vulnerable if they have added other sites to the whitelist. In other words, if you did not add in any site into the software installation whitelist, you are safe from this issue.

Anyway, firefox user can save yourself while waiting for the patch to be released by Mozilla Foundation, by switching off JavaScript in the meantime.

The following are steps to swich off JavaScript:-

1. Go to Tools, then click Options….
2. Select Web Features on the left panel.
3. Deselect the Enable JavaScript box.

[Source]