221 matches found
Mandriva Linux Security Advisory : firefox (MDVSA-2009:290-1)
Security issues were identified and fixed in firefox 3.0.x : Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code...
CVE-2009-3374
The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to...
CVE-2009-3374
The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to...
Design/Logic Flaw
The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to...
CVE-2009-3374
CVE-2009-3374 affects Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4. The XPCVariant::VariantDataToJS function in the XPCOM layer does not enforce restrictions on interaction between chrome privileged code and objects from remote sites, allowing a remote attacker to execute arbitrary ...
[SECURITY] Fedora 11 Update: hulahop-0.4.9-9.fc11
The hulalop library contains a widget for embedding mozilla. It's based on pyxpcom and give access to the whole mozilla xpcom API through python...
Firefox < 3.0.15 Multiple Vulnerabilities
The installed version of Firefox is earlier than 3.0.15. Such versions are potentially affected by the following security issues : - It may be possible for a malicious web page to steal form history. MFSA 2009-52 - By predicting the filename of an already downloaded file in the downloads director...
CVE-2009-3374: Undefined Security Weakness
The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to...
You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2009-57 Mozilla Foundation Security Advisory 2009-57
Mozilla Foundation Security Advisory 2009-57 Title: Chrome privilege escalation in XPCVariant::VariantDataToJS Impact: Critical Announced: October 27, 2009 Reporter: mozbugra4 Products: Firefox Fixed in: Firefox 3.5.4 Firefox 3.0.15 Description Mozilla security researcher mozbugra4 reported that...
Chrome privilege escalation in XPCVariant::VariantDataToJS() — Mozilla
Mozilla security researcher mozbugra4 reported that the XPCOM utility XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects before returning them to chrome callers. This could result in chrome privileged code calling methods on an object which had previously been created or modified by web...
Mozilla Firefox XPCOM Plugin Access Control (CVE-2005-0527)
Mozilla Firefox is a popular web-browser available for many platforms. Firefox implements a cross-platform component architecture called XPCOM Cross-Platform Component Object Model that allows for the development of modular software such as browser plug-ins. These objects can be invoked through...
[SECURITY] Fedora 11 Update: hulahop-0.4.9-8.fc11
The hulalop library contains a widget for embedding mozilla. It's based on pyxpcom and give access to the whole mozilla xpcom API through python...
CoolPreviews - Firefox Extension - Chrome Privileged Code Injection
, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. CoolPreviews Chrome Privileged Code Injection +-----------+ |Description| +-----------+ Security-Assessment.com discovered that Coolpreviews stack feature is vulnerable to Cross Sit...
ScribeFire Firefox Extension - Privileged Code Injection
, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. ScribeFire Firefox Extension Code Injection Vulnerability Versions affected: 3.4.2 +-----------+ |Description| +-----------+ The ScribeFire Firefox extension provides an interface f...
Update Scanner - Firefox Extension - Chrome Privileged Code Injection
, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Update Scanner Chrome Privileged Code Injection +-----------+ |Description| +-----------+ Security-Assessment.com discovered that Update Scanner is vulnerable to Cross Site Scriptin...
Feed Sidebar Firefox Extension - Privileged Code Injection
, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Feed Sidebar Firefox Extension Code Injection Vulnerability Versions affected: 3.2 +-----------+ |Description| +-----------+ The Feed Sidebar Firefox extension will generate a previ...
WizzRSS Firefox Extension - Privileged Code Injection
, , . .' '. ', . , '. , ., , / / / ==/ / / / / / / | Y Y / /| / /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. WizzRSS Firefox Extension Code Injection Vulnerability Versions affected: WizzRSS Reader 3.1.0.0 WizzRSS Reader Lite 3.0.0.9b +-----------+ |Description| +-----------+ The WizzRSS...
[SECURITY] Fedora 11 Update: hulahop-0.4.9-7.fc11
The hulalop library contains a widget for embedding mozilla. It's based on pyxpcom and give access to the whole mozilla xpcom API through python...
[SECURITY] Fedora 11 Update: hulahop-0.4.9-6.fc11
The hulalop library contains a widget for embedding mozilla. It's based on pyxpcom and give access to the whole mozilla xpcom API through python...
CVE-2008-5017
Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service crash via unknown vectors...