Published: 24/06/2010 Updated: 19/09/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Mozilla Firefox 3.5.x prior to 3.5.10 and 3.6.x prior to 3.6.4, and SeaMonkey prior to 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote malicious users to conduct cross-site scripting (XSS) attacks via an uploaded HTML document.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox 3.5.3
mozilla firefox 3.5.4
mozilla firefox 3.5.1
mozilla firefox 3.5.2
mozilla firefox 3.5.5
mozilla firefox 3.5.6
mozilla firefox 3.5
mozilla firefox 3.5.7
mozilla firefox 3.5.9
mozilla seamonkey 2.0.3
mozilla seamonkey 2.0.2
mozilla seamonkey 2.0
mozilla seamonkey 1.1.13
mozilla seamonkey 1.1.12
mozilla seamonkey 1.1.5
mozilla seamonkey 1.1.4
mozilla seamonkey 1.0.8
mozilla seamonkey 1.0.7
mozilla seamonkey 1.0
mozilla seamonkey
mozilla seamonkey 1.1.15
mozilla seamonkey 1.1.14
mozilla seamonkey 1.1.7
mozilla seamonkey 1.1.6
mozilla seamonkey 1.1
mozilla seamonkey 1.0.9
mozilla seamonkey 1.0.2
mozilla seamonkey 1.0.1
mozilla seamonkey 2.0.1
mozilla seamonkey 1.1.19
mozilla seamonkey 1.1.18
mozilla seamonkey 1.1.11
mozilla seamonkey 1.1.10
mozilla seamonkey 1.1.3
mozilla seamonkey 1.1.2
mozilla seamonkey 1.0.6
mozilla seamonkey 1.0.5
mozilla seamonkey 1.1.17
mozilla seamonkey 1.1.16
mozilla seamonkey 1.1.9
mozilla seamonkey 1.1.8
mozilla seamonkey 1.1.1
mozilla seamonkey 1.0.4
mozilla seamonkey 1.0.3
mozilla firefox 3.6
mozilla firefox 3.6.2
mozilla firefox 3.6.3

Synopsis Moderate: thunderbird security update Type/Severity Security Advisory: Moderate Topic An updated thunderbird package that fixes several security issues is nowavailable for Red Hat Enterprise Linux 4The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common V ...

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-0183 "wushi" discovered that incorrect pointer handling in the frame processing code could lead to the execution of arbitrary code CVE-20 ...

Firefox could be made to run programs as your login if it opened a specially crafted file or website ...

This update fixes a problem with Firefox not installing alongside the old Firefox 2 package ...

Firefox could be made to run programs as your login if it opened a specially crafted file or website ...

This update is for use with the new Xulrunner provided in USN-930-1 ...

This update is for use with the new Xulrunner provided in USN-930-4 ...

Firefox could be made to run programs as your login if it opened a specially crafted file or website ...

Mozilla Foundation Security Advisory 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present Announced June 22, 2010 Reporter Ilja van Sprundel Impact Moderate Products Firefox, SeaMonkey ...

CWE-79 https://bugzilla.mozilla.org/show_bug.cgi?id=537120 http://www.securityfocus.com/bid/41050 http://www.mozilla.org/security/announce/2010/mfsa2010-32.html http://www.redhat.com/support/errata/RHSA-2010-0499.html http://www.vupen.com/english/advisories/2010/1551 http://www.redhat.com/support/errata/RHSA-2010-0500.html http://www.vupen.com/english/advisories/2010/1556 http://www.securityfocus.com/bid/41103 http://www.vupen.com/english/advisories/2010/1557 http://www.redhat.com/support/errata/RHSA-2010-0501.html http://secunia.com/advisories/40326 http://www.securitytracker.com/id?1024138 http://www.mandriva.com/security/advisories?name=MDVSA-2010:125 http://support.avaya.com/css/P8/documents/100091069 http://secunia.com/advisories/40401 http://www.vupen.com/english/advisories/2010/1640 http://www.ubuntu.com/usn/usn-930-2 http://ubuntu.com/usn/usn-930-1 http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html http://secunia.com/advisories/40481 http://www.vupen.com/english/advisories/2010/1773 http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html http://www.vupen.com/english/advisories/2010/1592 https://exchange.xforce.ibmcloud.com/vulnerabilities/59667 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14186 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10168 https://access.redhat.com/errata/RHSA-2010:0544 https://nvd.nist.gov https://usn.ubuntu.com/930-1/https://www.debian.org/security/./dsa-2064

CVE-2010-1197

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect