what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2010-173

Posted Sep 11, 2010

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-173 - Security issues were identified and fixed in firefox and mozilla-thinderbird. Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict read access to the statusText property of XMLHttpRequest objects, which allows remote attackers to discover the existence of intranet web servers via cross-origin requests. Cross-site scripting vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 allows user-assisted remote attackers to inject arbitrary web script or HTML via a selection that is added to a document in which the designMode property is enabled. Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict use of the type attribute of an OBJECT element to set a document's charset, which allows remote attackers to bypass cross-site scripting protection mechanisms via UTF-7 encoding. Various other issues were addressed.

tags | advisory, remote, web, arbitrary, xss

systems | linux, mandriva

advisories | CVE-2010-2764, CVE-2010-2769, CVE-2010-2768, CVE-2010-2762, CVE-2010-2766, CVE-2010-3167, CVE-2010-3168, CVE-2010-2760, CVE-2010-2765, CVE-2010-3166, CVE-2010-2767, CVE-2010-3169

SHA-256 | d2c5330326c33ebfdc1dc274a3d9263970b7874baf781cfc5de60069bb4084fe

Download | Favorite | View

Related Files

No related files