Re: Web of Science issues

Hi Steve.

You might want to encourage FireFox 68 users to update. See below.

Best,

Laszlo.

https://www.computerworld.com/article/3251749/whats-in-the-latest-firefox-update-firefox-69-thwarts-web-tracking-by-default-for-everyone.html
has :-
The organization's security engineers also patched 20 vulnerabilities, one tagged "Critical" and 11 marked "High," the organization's two top threat ratings. The single critical flaw only affected Windows, Mozilla said in its patching commentary<https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/>.

The patch commentary includes :-

Fixed in Firefox 69

CVE-2019-11751: Malicious code execution through command line parameters<https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/#CVE-2019-11751>

Reporter
Ping Fan (Zetta) Ke of VXRL working with iDefense Labs
Impact
critical
Description

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application. This can be used to write a log file to an arbitrary location such as the Windows 'Startup' folder.
Note: this issue only affects Firefox on Windows operating systems.



Laszlo Gercsov

Senior Systems Analyst Library Systems

Library  |  Level 4
16 Macquarie Drive
Macquarie University, NSW 2109, Australia

T: +61 2 9850 6533 | F: +61 2 9850 7568

M: + 61 402 175 101  |  mq.edu.au/library<http://mq.edu.au/>

[Macquarie University]<http://mq.edu.au/>

CRICOS Provider Number 00002J. Think before you print.
Please consider the environment before printing this email.

This message is intended for the addressee named and may
contain confidential information. If you are not the intended
recipient, please delete it and notify the sender. Views expressed
in this message are those of the individual sender, and are not
necessarily the views of Macquarie University

________________________________
From: EZproxy List <[email protected]> on behalf of Steve Brown <[email protected]>
Sent: Thursday, 26 September 2019 1:18 AM
To: [email protected] <[email protected]>
Subject: Re: [EZPROXY-L] Web of Science issues

I posted to this listserv at the end of August with this problem (only happening in Firefox for some users from what I can tell). We still don't have a solution. WOS support's answer so far has been:

1. Talk to OCLC to fix the problem (even though Clarivate provides the stanza to OCLC that we are using as an IncludeFile).
2. Users must have the absolute latest version of Firefox for Web of Science to work, which seems ridiculous to be that rigid in browser expectations. (A user with Firefox version 68 is having the problem, while my Firefox 69 works fine).

I've been at a loss on how to fix it.
Steve

********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html<https://protect-au.mimecast.com/s/wPu0C1WLjwskw9PkIGDaZe?domain=oclc.org>">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].

********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].