Published: 09/09/2010 Updated: 19/09/2017

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x prior to 3.6.9 and Thunderbird 3.1.x prior to 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote malicious users to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox 3.6.3
mozilla firefox 3.6.4
mozilla firefox 3.6.6
mozilla firefox 3.6.8
mozilla firefox 3.6.7
mozilla firefox 3.6.2
mozilla firefox 3.6
mozilla thunderbird 3.1.2
mozilla thunderbird 3.1
mozilla thunderbird 3.1.1

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic Updated firefox packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4 and 5The Red Hat Security Response Team has rated this update as having criticalsecurity impact Common Vulner ...

Firefox could be made to crash or possibly run programs as your login if it opened a specially crafted file or website ...

This update provides stability updates for Firefox and Xulrunner ...

Mozilla Foundation Security Advisory 2010-59 SJOW creates scope chains ending in outer object Announced September 7, 2010 Reporter Blake Kaplan Impact Critical Products Firefox, Thunderbird Fixed in ...

CWE-264 http://www.mozilla.org/security/announce/2010/mfsa2010-59.html https://bugzilla.mozilla.org/show_bug.cgi?id=584180 http://www.mandriva.com/security/advisories?name=MDVSA-2010:173 http://www.vupen.com/english/advisories/2010/2323 http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox http://support.avaya.com/css/P8/documents/100112690 http://www.securityfocus.com/bid/43092 http://secunia.com/advisories/42867 http://www.vupen.com/english/advisories/2011/0061 https://exchange.xforce.ibmcloud.com/vulnerabilities/61656 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11492 https://access.redhat.com/errata/RHSA-2010:0681 https://nvd.nist.gov https://usn.ubuntu.com/975-1/

CVE-2010-2762

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect