The XrayWrapper implementation in Mozilla Firefox prior to 22.0, Firefox ESR 17.x prior to 17.0.7, Thunderbird prior to 17.0.7, and Thunderbird ESR 17.x prior to 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote malicious users to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
mozilla firefox 19.0 |
||
mozilla firefox 19.0.1 |
||
mozilla firefox 20.0.1 |
||
mozilla firefox |
||
mozilla firefox 19.0.2 |
||
mozilla firefox 20.0 |
||
mozilla firefox esr 17.0.2 |
||
mozilla firefox esr 17.0.1 |
||
mozilla firefox esr 17.0 |
||
mozilla firefox esr 17.0.5 |
||
mozilla firefox esr 17.0.6 |
||
mozilla firefox esr 17.0.3 |
||
mozilla firefox esr 17.0.4 |
||
mozilla thunderbird 17.0.2 |
||
mozilla thunderbird 17.0 |
||
mozilla thunderbird 17.0.1 |
||
mozilla thunderbird 17.0.3 |
||
mozilla thunderbird |
||
mozilla thunderbird 17.0.4 |
||
mozilla thunderbird 17.0.5 |
||
mozilla thunderbird esr 17.0 |
||
mozilla thunderbird esr 17.0.1 |
||
mozilla thunderbird esr 17.0.2 |
||
mozilla thunderbird esr 17.0.3 |
||
mozilla thunderbird esr 17.0.6 |
||
mozilla thunderbird esr 17.0.4 |
||
mozilla thunderbird esr 17.0.5 |