Lucene search
HistoryDec 10, 2010 - 7:00 p.m.
CVE-2010-3773
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
7.1 High
AI Score
Confidence
Low
0.018 Low
EPSS
Percentile
88.4%
Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute arbitrary JavaScript via a crafted HTTP response. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-0179.
Affected configurations
Node
mozillafirefoxMatch3.6
ORmozillafirefoxMatch3.6.2
ORmozillafirefoxMatch3.6.3
ORmozillafirefoxMatch3.6.4
ORmozillafirefoxMatch3.6.6
ORmozillafirefoxMatch3.6.7
ORmozillafirefoxMatch3.6.8
ORmozillafirefoxMatch3.6.9
ORmozillafirefoxMatch3.6.10
ORmozillafirefoxMatch3.6.11
ORmozillafirefoxMatch3.6.12
Node
mozillaseamonkeyRange≤2.0.10
ORmozillaseamonkeyMatch1.0
ORmozillaseamonkeyMatch1.0alpha
ORmozillaseamonkeyMatch1.0beta
ORmozillaseamonkeyMatch1.0.1
ORmozillaseamonkeyMatch1.0.2
ORmozillaseamonkeyMatch1.0.3
ORmozillaseamonkeyMatch1.0.4
ORmozillaseamonkeyMatch1.0.5
ORmozillaseamonkeyMatch1.0.6
ORmozillaseamonkeyMatch1.0.7
ORmozillaseamonkeyMatch1.0.8
ORmozillaseamonkeyMatch1.0.9
ORmozillaseamonkeyMatch1.1
ORmozillaseamonkeyMatch1.1alpha
ORmozillaseamonkeyMatch1.1beta
ORmozillaseamonkeyMatch1.1.1
ORmozillaseamonkeyMatch1.1.2
ORmozillaseamonkeyMatch1.1.3
ORmozillaseamonkeyMatch1.1.4
ORmozillaseamonkeyMatch1.1.5
ORmozillaseamonkeyMatch1.1.6
ORmozillaseamonkeyMatch1.1.7
ORmozillaseamonkeyMatch1.1.8
ORmozillaseamonkeyMatch1.1.9
ORmozillaseamonkeyMatch1.1.10
ORmozillaseamonkeyMatch1.1.11
ORmozillaseamonkeyMatch1.1.12
ORmozillaseamonkeyMatch1.1.13
ORmozillaseamonkeyMatch1.1.14
ORmozillaseamonkeyMatch1.1.15
ORmozillaseamonkeyMatch1.1.16
ORmozillaseamonkeyMatch1.1.17
ORmozillaseamonkeyMatch1.1.18
ORmozillaseamonkeyMatch1.1.19
ORmozillaseamonkeyMatch1.5.0.8
ORmozillaseamonkeyMatch1.5.0.9
ORmozillaseamonkeyMatch1.5.0.10
ORmozillaseamonkeyMatch2.0
ORmozillaseamonkeyMatch2.0alpha_1
ORmozillaseamonkeyMatch2.0alpha_2
ORmozillaseamonkeyMatch2.0alpha_3
ORmozillaseamonkeyMatch2.0beta_1
ORmozillaseamonkeyMatch2.0beta_2
ORmozillaseamonkeyMatch2.0rc1
ORmozillaseamonkeyMatch2.0rc2
ORmozillaseamonkeyMatch2.0.1
ORmozillaseamonkeyMatch2.0.2
ORmozillaseamonkeyMatch2.0.3
ORmozillaseamonkeyMatch2.0.4
ORmozillaseamonkeyMatch2.0.5
ORmozillaseamonkeyMatch2.0.6
ORmozillaseamonkeyMatch2.0.7
ORmozillaseamonkeyMatch2.0.8
ORmozillaseamonkeyMatch2.0.9
Node
mozillafirefoxRange≤3.5.15
ORmozillafirefoxMatch0.1
ORmozillafirefoxMatch0.2
ORmozillafirefoxMatch0.3
ORmozillafirefoxMatch0.4
ORmozillafirefoxMatch0.5
ORmozillafirefoxMatch0.6
ORmozillafirefoxMatch0.6.1
ORmozillafirefoxMatch0.7
ORmozillafirefoxMatch0.7.1
ORmozillafirefoxMatch0.8
ORmozillafirefoxMatch0.9
ORmozillafirefoxMatch0.9rc
ORmozillafirefoxMatch0.9.1
ORmozillafirefoxMatch0.9.2
ORmozillafirefoxMatch0.9.3
ORmozillafirefoxMatch0.10
ORmozillafirefoxMatch0.10.1
ORmozillafirefoxMatch1.0
ORmozillafirefoxMatch1.0preview_release
ORmozillafirefoxMatch1.0.1
ORmozillafirefoxMatch1.0.2
ORmozillafirefoxMatch1.0.3
ORmozillafirefoxMatch1.0.4
ORmozillafirefoxMatch1.0.5
ORmozillafirefoxMatch1.0.6
ORmozillafirefoxMatch1.0.7
ORmozillafirefoxMatch1.0.8
ORmozillafirefoxMatch1.4.1
ORmozillafirefoxMatch1.5
ORmozillafirefoxMatch1.5beta1
ORmozillafirefoxMatch1.5beta2
ORmozillafirefoxMatch1.5.0.1
ORmozillafirefoxMatch1.5.0.2
ORmozillafirefoxMatch1.5.0.3
ORmozillafirefoxMatch1.5.0.4
ORmozillafirefoxMatch1.5.0.5
ORmozillafirefoxMatch1.5.0.6
ORmozillafirefoxMatch1.5.0.7
ORmozillafirefoxMatch1.5.0.8
ORmozillafirefoxMatch1.5.0.9
ORmozillafirefoxMatch1.5.0.10
ORmozillafirefoxMatch1.5.0.11
ORmozillafirefoxMatch1.5.0.12
ORmozillafirefoxMatch1.5.1
ORmozillafirefoxMatch1.5.2
ORmozillafirefoxMatch1.5.3
ORmozillafirefoxMatch1.5.4
ORmozillafirefoxMatch1.5.5
ORmozillafirefoxMatch1.5.6
ORmozillafirefoxMatch1.5.7
ORmozillafirefoxMatch1.5.8
ORmozillafirefoxMatch1.8
ORmozillafirefoxMatch2.0
ORmozillafirefoxMatch2.0.0.1
ORmozillafirefoxMatch2.0.0.2
ORmozillafirefoxMatch2.0.0.3
ORmozillafirefoxMatch2.0.0.4
ORmozillafirefoxMatch2.0.0.5
ORmozillafirefoxMatch2.0.0.6
ORmozillafirefoxMatch2.0.0.7
ORmozillafirefoxMatch2.0.0.8
ORmozillafirefoxMatch2.0.0.9
ORmozillafirefoxMatch2.0.0.10
ORmozillafirefoxMatch2.0.0.11
ORmozillafirefoxMatch2.0.0.12
ORmozillafirefoxMatch2.0.0.13
ORmozillafirefoxMatch2.0.0.14
ORmozillafirefoxMatch2.0.0.15
ORmozillafirefoxMatch2.0.0.16
ORmozillafirefoxMatch2.0.0.17
ORmozillafirefoxMatch2.0.0.18
ORmozillafirefoxMatch2.0.0.19
ORmozillafirefoxMatch2.0.0.20
ORmozillafirefoxMatch3.0
ORmozillafirefoxMatch3.0.1
ORmozillafirefoxMatch3.0.2
ORmozillafirefoxMatch3.0.3
ORmozillafirefoxMatch3.0.4
ORmozillafirefoxMatch3.0.5
ORmozillafirefoxMatch3.0.6
ORmozillafirefoxMatch3.0.7
ORmozillafirefoxMatch3.0.8
ORmozillafirefoxMatch3.0.9
ORmozillafirefoxMatch3.0.10
ORmozillafirefoxMatch3.0.11
ORmozillafirefoxMatch3.0.12
ORmozillafirefoxMatch3.0.13
ORmozillafirefoxMatch3.0.14
ORmozillafirefoxMatch3.0.15
ORmozillafirefoxMatch3.0.16
ORmozillafirefoxMatch3.0.17
ORmozillafirefoxMatch3.5
ORmozillafirefoxMatch3.5.1
ORmozillafirefoxMatch3.5.2
ORmozillafirefoxMatch3.5.3
ORmozillafirefoxMatch3.5.4
ORmozillafirefoxMatch3.5.5
ORmozillafirefoxMatch3.5.6
ORmozillafirefoxMatch3.5.7
ORmozillafirefoxMatch3.5.8
ORmozillafirefoxMatch3.5.9
ORmozillafirefoxMatch3.5.10
ORmozillafirefoxMatch3.5.11
ORmozillafirefoxMatch3.5.12
ORmozillafirefoxMatch3.5.13
ORmozillafirefoxMatch3.5.14
References
lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html
lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html
lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html
lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html
lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html
secunia.com/advisories/42716
secunia.com/advisories/42818
support.avaya.com/css/P8/documents/100124650
www.debian.org/security/2010/dsa-2132
www.mandriva.com/security/advisories?name=MDVSA-2010:251
www.mozilla.org/security/announce/2010/mfsa2010-82.html
www.redhat.com/support/errata/RHSA-2010-0966.html
www.securityfocus.com/bid/45354
www.ubuntu.com/usn/USN-1019-1
www.vupen.com/english/advisories/2011/0030
bugzilla.mozilla.org/show_bug.cgi?id=554449
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11960
Related
veracode
veracode
Arbitrary Code Execution
2020-04-10 00:52:33
Privilege Escalation
2020-04-10 00:45:25
securityvulns
securityvulns
Mozilla Foundation Security Advisory 2010-82
2010-12-10 00:00:00
Mozilla Foundation Security Advisory 2010-21
2010-04-06 00:00:00
xulrunner multiple security vulnerabilities
2010-04-06 00:00:00
cvelist
cvelist
CVE-2010-3773
2010-12-10 18:00:00
CVE-2010-0179
2010-04-05 17:00:00
mozilla
mozilla
Incomplete fix for CVE-2010-0179 — Mozilla
2010-12-09 00:00:00
Arbitrary code execution with Firebug XMLHttpRequestSpy — Mozilla
2010-03-30 00:00:00
prion
prion
Design/Logic Flaw
2010-12-10 19:00:00
Code injection
2010-04-05 17:30:00
cve
cve
CVE-2010-3773
2010-12-10 19:00:02
CVE-2010-0179
2010-04-05 17:30:00
ubuntucve
ubuntucve
CVE-2010-3773
2010-12-09 00:00:00
CVE-2010-0179
2010-04-05 00:00:00
nessus
nessus
Mozilla Firefox < 3.5.16 Multiple Vulnerabilities
2010-12-10 00:00:00
Mozilla Firefox 3.6.x < 3.6.13 Multiple Vulnerabilities
2010-12-09 00:00:00
Mozilla Firefox 3.6.x < 3.6.13 Multiple Vulnerabilities
2010-12-09 00:00:00
openvas
openvas
Mozilla Products Firebug Code Execution Vulnerability (Windows)
2010-04-13 00:00:00
Mozilla Products Firebug Code Execution Vulnerability - Windows
2010-04-13 00:00:00
Fedora Update for xulrunner FEDORA-2010-18775
2010-12-28 00:00:00
nvd
nvd
CVE-2010-0179
2010-04-05 17:30:00
redhat
redhat
(RHSA-2010:0966) Critical: firefox security update
2010-12-09 00:00:00
(RHSA-2010:0332) Critical: firefox security update
2010-03-30 00:00:00
centos
centos
firefox security update
2011-01-27 08:53:21
firefox security update
2010-04-06 21:01:59
debian
debian
[BSA-013] Security Update for iceweasel
2011-01-02 19:45:28
[SECURITY] [DSA 2027-1] New xulrunner packages fix several vulnerabilities
2010-04-03 17:50:19
[SECURITY] [DSA 2132-1] New xulrunner packages fix several vulnerabilities
2010-12-11 12:03:17
suse
suse
remote code execution in MozillaFirefox,MozillaThunderbird,Seamonkey
2011-01-05 11:25:44
freebsd
freebsd
mozilla -- multiple vulnerabilities
2010-12-09 00:00:00
mozilla -- multiple vulnerabilities
2010-03-30 00:00:00
osv
osv
xulrunner - several vulnerabilities
2010-04-03 00:00:00
xulrunner - several vulnerabilities
2010-12-11 00:00:00
oraclelinux
oraclelinux
firefox security update
2010-03-31 00:00:00
firefox security update
2010-12-10 00:00:00
ubuntu
ubuntu
Firefox 3.0 and Xulrunner vulnerabilities
2010-04-09 00:00:00
Firefox 3.5 and Xulrunner vulnerabilities
2010-04-09 00:00:00
Firefox and Xulrunner vulnerabilities
2010-12-09 00:00:00
fedora
fedora
[SECURITY] Fedora 13 Update: galeon-2.0.7-36.fc13
2010-12-10 20:25:42
[SECURITY] Fedora 14 Update: perl-Gtk2-MozEmbed-0.08-6.fc14.22
2010-12-10 20:27:49
[SECURITY] Fedora 13 Update: gnome-web-photo-0.9-15.fc13
2010-12-10 20:25:42
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
7.1 High
AI Score
Confidence
Low
0.018 Low
EPSS
Percentile
88.4%
Related for NVD:CVE-2010-3773