Mozilla Foundation Security Advisory 2010-13

Mozilla Foundation Security Advisory 2010-13 Title: Content policy bypass with image preloading Impact: Moderate Announced: March 23, 2010 Reporter: Josh Soref, Nokia Products: Firefox 3.6 Fixed in: Firefox 3.6.2 Description Mozilla developer Josh Soref of Nokia reported that documents failed to...

Mozilla Foundation Security Advisory 2010-09

Mozilla Foundation Security Advisory 2010-09 Title: Deleted frame reuse in multipart/x-mixed-replace image Impact: Moderate Announced: March 23, 2010 Reporter: regenrecht via TippingPoint's Zero Day Initiative Products: Firefox 3.6 Fixed in: Firefox 3.6.2 Description Security researcher regenrech...

Mozilla Foundation Security Advisory 2010-15

Mozilla Foundation Security Advisory 2010-15 Title: Asynchronous Auth Prompt attaches to wrong window Impact: Low Announced: March 23, 2010 Reporter: Justin Dolske Products: Firefox 3.6 Fixed in: Firefox 3.6.2 Description Mozilla developer Justin Dolske reported that the new asynchronous...

Mozilla Foundation Security Advisory 2010-10

Mozilla Foundation Security Advisory 2010-10 Title: XSS via plugins and unprotected Location object Impact: High Announced: March 23, 2010 Reporter: Blake Kaplan Products: Firefox 3.6 Fixed in: Firefox 3.6.2 Description Mozilla developer Blake Kaplan reported that the window.location object was...

CVE-2010-0182

The XMLDocument::load function in Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4 does not perform the expected nsIContentPolicy checks during loading of content by XML documents, which allows attackers to bypass intended access restrictio...

Firefox Multiple Vulnerabilities Mar-10 (Windows)

The host is installed with Firefox browser and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodfirefoxmultvulnmar10win.nasl 5394 2017-02-22 09:22:42Z teissa $ Firefox Multiple Vulnerabilities Mar-10 Windows Authors: Antu Sanadi Copyright: Copyright c 2010 SecPod,...

Mozilla Firefox Multiple Vulnerabilities (Mar 2010) - Linux

Mozilla Firefox is prone to multiple vulnerabilities. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Design/Logic Flaw

The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does not apply scheme restrictions and policy restrictions to the image's URL, which might allow remote attackers to cause a denial of service...

Cross site scripting

Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting XSS attacks via vectors that are specific to each affected plugin...

CVE-2010-0168

Technical details for CVE-2010-0168 are not provided in the supplied documents. The materials reference Firefox historical fixes and related advisories but do not describe affected components, root cause, impact, or remediation for this CVE. Monitor for updates.

CVE-2010-0170

Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting XSS attacks via vectors that are specific to each affected plugin...

CVE-2010-1121

Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collectio...

Mozilla Firefox 3.6 window.location对象非授权数据访问漏洞

CVE ID: CVE-2010-0170 Firefox是一款流行的开源WEB浏览器。 由于开发了新的机制来强制窗口与帧之间的同源策略，Firefox 3.6的浏览器引擎将window.location对象更改为正常的可覆盖JavaScript对象。但一些插件也使用这个对象判断页面来源以实施访问限制，因此恶意网页可以通过覆盖这个对象欺骗插件允许到其他站点或本地文件系统上数据的访问。 Mozilla Firefox 3.6 厂商补丁： Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mozilla.org/...

Mozilla Firefox < 3.6.2 Multiple Vulnerabilities.

The remote host is running a version of Mozilla Firefox 3.6.x earlier than 3.6.2. Such versions are potentially affected by multiple security issues : - The WOFF decoder contains an integer overflow in a font decrompression routine. MFSA 2010-08 - Deleted image frames are reused when handling...

Mozilla Firefox Unspecified Vulnerability (Windows)

The host is running Mozilla Firefox and is prone to unspecified vulnerability. OpenVAS Vulnerability Test $Id: secpodfirefoxunspecifiedvuln.nasl 5394 2017-02-22 09:22:42Z teissa $ Mozilla Firefox Unspecified Vulnerability Windows Authors: Madhuri D Copyright: Copyright c 2010 SecPod,...

XSS using addEventListener and setTimeout on a wrapped object — Mozilla

Mozilla security researcher mozbugra4 reports that by using an appropriately wrapped object it was possible to bypass the fix for MFSA 2007-19. Prior to Firefox 3.6 this gives an attacker the ability to perform cross-site scripting attacks against arbitrary sites as in the original MFSA 2007-19...

Integer overflow

Integer overflow in the decompression functionality in the Web Open Fonts Format WOFF decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as demonstrated by the vdff modul...

Namoroka 3.6 Alpha 1 Remote Memory Corrupt (Local Crash Exploit)

Exploit for unknown platform in category dos / poc ================================================================ Namoroka 3.6 Alpha 1 Remote Memory Corrupt Local Crash Exploit ================================================================ function DoS var buffer = '\x41'; for i...

Mozilla Firefox 3.6 (memory corruption) Denial Of Service

Exploit for unknown platform in category dos / poc ========================================================= Mozilla Firefox 3.6 memory corruption Denial Of Service ========================================================= - Discovered by: Crux - Exploit name: Mozilla Firefox 3.6 memory corruptio...

Firefox Multiple Vulnerabilities (Feb 2010) - Windows

Firefox Browser is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...