Lucene search

K
mozillaMozilla FoundationMFSA2008-24
HistoryJul 01, 2008 - 12:00 a.m.

Chrome script loading from fastload file β€” Mozilla

2008-07-0100:00:00
Mozilla Foundation
www.mozilla.org
14

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.222 Low

EPSS

Percentile

96.4%

Mozilla security researcher moz_bug_r_a4 reported that when non-priviliged XUL documents include scripts from chrome: URIs used in the browser it was possible to take advantage of the privilege level stored in the pre-compiled β€œfastload” file. This could allow an attacker to run arbitrary JavaScript code with chrome privileges.

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.222 Low

EPSS

Percentile

96.4%