184 matches found
DSA-2180-1 iceape - several
Bulletin has no description...
SuSE 10 Security Update : Mozilla XULRunner (ZYPP Patch Number 6617)
The Mozilla XULRunner engine was updated to version 1.9.0.15 to fix various bugs and security issues. The following security issues have been fixed : - Security researcher Paul Stone reported that a user's form history, both from web content as well as the smart location bar, was vulnerable to...
SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6609)
The Mozilla Firefox browser was updated to version 3.5.4 to fix various bugs and security issues. The following security issues have been fixed : - Security researcher Paul Stone reported that a user's form history, both from web content as well as the smart location bar, was vulnerable to theft....
Mandriva Linux Security Advisory : firefox (MDVSA-2009:294)
Security issues were identified and fixed in firefox 3.5.x : Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code...
[SECURITY] Fedora 11 Update: hulahop-0.4.9-12.fc11
The hulalop library contains a widget for embedding mozilla. It's based on pyxpcom and give access to the whole mozilla xpcom API through python...
Yoono Firefox Extension - Privileged Code Injection
, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Yoono Firefox Extension Code Injection Vulnerability Versions affected: 6.1.1 +-----------+ |Description| +-----------+ The Yoono Firefox extension provides an interface for users t...
Mozilla Products QueryInterface Method Memory Corruption (CVE-2006-0295)
The Mozilla Firefox browser adheres to most published Internet standards and is capable of processing static as well as dynamic HTML content. In addition to supporting the general protocols and standards, the Mozilla browsers implement several custom standards, one of which is the XPCOM component...
Mandriva Linux Security Advisory : firefox (MDVSA-2009:290-1)
Security issues were identified and fixed in firefox 3.0.x : Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code...
CVE-2009-3374
The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to...
CVE-2009-3374
The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to...
Design/Logic Flaw
The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to...
CVE-2009-3374
CVE-2009-3374 affects Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4. The XPCVariant::VariantDataToJS function in the XPCOM layer does not enforce restrictions on interaction between chrome privileged code and objects from remote sites, allowing a remote attacker to execute arbitrary ...
[SECURITY] Fedora 11 Update: hulahop-0.4.9-9.fc11
The hulalop library contains a widget for embedding mozilla. It's based on pyxpcom and give access to the whole mozilla xpcom API through python...
Firefox < 3.0.15 Multiple Vulnerabilities
The installed version of Firefox is earlier than 3.0.15. Such versions are potentially affected by the following security issues : - It may be possible for a malicious web page to steal form history. MFSA 2009-52 - By predicting the filename of an already downloaded file in the downloads director...
You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2009-57 Mozilla Foundation Security Advisory 2009-57
Mozilla Foundation Security Advisory 2009-57 Title: Chrome privilege escalation in XPCVariant::VariantDataToJS Impact: Critical Announced: October 27, 2009 Reporter: mozbugra4 Products: Firefox Fixed in: Firefox 3.5.4 Firefox 3.0.15 Description Mozilla security researcher mozbugra4 reported that...
Chrome privilege escalation in XPCVariant::VariantDataToJS() — Mozilla
Mozilla security researcher mozbugra4 reported that the XPCOM utility XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects before returning them to chrome callers. This could result in chrome privileged code calling methods on an object which had previously been created or modified by web...
Mozilla Firefox XPCOM Plugin Access Control (CVE-2005-0527)
Mozilla Firefox is a popular web-browser available for many platforms. Firefox implements a cross-platform component architecture called XPCOM Cross-Platform Component Object Model that allows for the development of modular software such as browser plug-ins. These objects can be invoked through...
[SECURITY] Fedora 11 Update: hulahop-0.4.9-8.fc11
The hulalop library contains a widget for embedding mozilla. It's based on pyxpcom and give access to the whole mozilla xpcom API through python...
CoolPreviews - Firefox Extension - Chrome Privileged Code Injection
, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. CoolPreviews Chrome Privileged Code Injection +-----------+ |Description| +-----------+ Security-Assessment.com discovered that Coolpreviews stack feature is vulnerable to Cross Sit...
Update Scanner - Firefox Extension - Chrome Privileged Code Injection
, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Update Scanner Chrome Privileged Code Injection +-----------+ |Description| +-----------+ Security-Assessment.com discovered that Update Scanner is vulnerable to Cross Site Scriptin...