Mozilla Foundation Security Advisory 2010-10

2010-04-06T00:00:00
ID SECURITYVULNS:DOC:23549
Type securityvulns
Reporter Securityvulns
Modified 2010-04-06T00:00:00

Description

Mozilla Foundation Security Advisory 2010-10

Title: XSS via plugins and unprotected Location object Impact: High Announced: March 23, 2010 Reporter: Blake Kaplan Products: Firefox 3.6

Fixed in: Firefox 3.6.2 Description

Mozilla developer Blake Kaplan reported that the window.location object was made a normal overridable JavaScript object in the Firefox 3.6 browser engine (Gecko 1.9.2) because new mechanisms were developed to enforce the same-origin policy between windows and frames. This object is unfortunately also used by some plugins to determine the page origin used for access restrictions. A malicious page could override this object to fool a plugin into granting access to data on another site or the local file system. The behavior of older Firefox versions has been restored.

This flaw does not affect earlier versions of Firefox, or other programs such as Thunderbird or SeaMonkey built on older versions of the browser engine. References

* https://bugzilla.mozilla.org/show_bug.cgi?id=541530
* CVE-2010-0170