Published: 18/02/2010 Updated: 19/09/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Mozilla Firefox 3.5.x prior to 3.5.11 and 3.6.x prior to 3.6.7, Thunderbird 3.0.x prior to 3.0.6 and 3.1.x prior to 3.1.1, and SeaMonkey prior to 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote malicious users to obtain sensitive information via a crafted document.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox 3.5.7
mozilla firefox 3.5.9
mozilla firefox 3.5.1
mozilla firefox 3.5.10
mozilla firefox 3.6.1
mozilla firefox 3.5.4
mozilla firefox 3.5.5
mozilla firefox 3.5.6
mozilla firefox 3.6.4
mozilla firefox 3.6.6
mozilla firefox 3.5.2
mozilla firefox 3.5.3
mozilla firefox 3.6.2
mozilla firefox 3.6.3
mozilla seamonkey 1.0
mozilla seamonkey 1.0.7
mozilla seamonkey 1.0.8
mozilla seamonkey 1.1.12
mozilla seamonkey 1.1.13
mozilla seamonkey 1.1.2
mozilla seamonkey 1.1.3
mozilla seamonkey 1.1
mozilla seamonkey 2.0.4
mozilla seamonkey 2.0
mozilla seamonkey 2.0a1pre
mozilla seamonkey
mozilla seamonkey 1.0.1
mozilla seamonkey 1.0.2
mozilla seamonkey 1.0.9
mozilla seamonkey 1.1.14
mozilla seamonkey 1.1.15
mozilla seamonkey 1.1.4
mozilla seamonkey 1.1.5
mozilla seamonkey 1.5.0.10
mozilla seamonkey 1.5.0.8
mozilla seamonkey 1.0.5
mozilla seamonkey 1.0.6
mozilla seamonkey 1.1.11
mozilla seamonkey 1.1.18
mozilla seamonkey 1.1.19
mozilla seamonkey 1.1.8
mozilla seamonkey 1.1.9
mozilla seamonkey 2.0.2
mozilla seamonkey 2.0.3
mozilla seamonkey 1.0.3
mozilla seamonkey 1.0.4
mozilla seamonkey 1.1.1
mozilla seamonkey 1.1.10
mozilla seamonkey 1.1.16
mozilla seamonkey 1.1.17
mozilla seamonkey 1.1.6
mozilla seamonkey 1.1.7
mozilla seamonkey 1.5.0.9
mozilla seamonkey 2.0.1
mozilla thunderbird 3.1
mozilla thunderbird 3.0.1
mozilla thunderbird 3.0.4
mozilla thunderbird 3.0.5
mozilla thunderbird 3.0.2
mozilla thunderbird 3.0.3

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic Updated firefox packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4 and 5The Red Hat Security Response Team has rated this update as having criticalsecurity impact Common Vulner ...

Debian Bug report logs - #570743 xulrunner: CVE-2010-0654 cross-origin CSS data theft Package: xulrunner; Maintainer for xulrunner is (unknown); Reported by: Michael Gilbert <michaelsgilbert@gmailcom> Date: Sun, 21 Feb 2010 07:21:01 UTC Severity: important Tags: fixed-upstream, security Found in versions 1923-1, 19 ...

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-0182 Wladimir Palant discovered that security checks in XML processing were insufficiently enforced CVE-2010-0654 Chris Evans discove ...

This update is for use with the new Xulrunner provided in USN-930-4 ...

Several flaws were discovered in the browser engine of Thunderbird If a user were tricked into viewing malicious content, a remote attacker could use this to crash Thunderbird or possibly run arbitrary code as the user invoking the program (CVE-2010-1211, CVE-2010-1212) ...

Firefox could be made to run programs as your login if it opened a specially crafted file or website ...

Mozilla Foundation Security Advisory 2010-46 Cross-domain data theft using CSS Announced July 20, 2010 Reporter Chris Evans Impact Moderate Products Firefox, SeaMonkey, Thunderbird Fixed in ...

CWE-200 http://code.google.com/p/chromium/issues/detail?id=9877 http://www.mozilla.org/security/announce/2010/mfsa2010-46.html https://bugzilla.mozilla.org/show_bug.cgi?id=524223 http://websec.sv.cmu.edu/css/css.pdf http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11811 https://access.redhat.com/errata/RHSA-2010:0547 https://nvd.nist.gov https://usn.ubuntu.com/930-5/https://www.debian.org/security/./dsa-2075

CVE-2010-0654

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect