 |
|
|
|
| From: | MOZILLA | | Date: | 06.04.2010 | | Subject: | Mozilla Foundation Security Advisory 2010-10 |
Mozilla Foundation Security Advisory 2010-10
Title: XSS via plugins and unprotected Location object
Impact: High
Announced: March 23, 2010
Reporter: Blake Kaplan
Products: Firefox 3.6
Fixed in: Firefox 3.6.2
Description
Mozilla developer Blake Kaplan reported that the window.location object was made a normal overridable JavaScript object in the Firefox 3.6 browser engine (Gecko 1.9.2) because new mechanisms were developed to enforce the same-origin policy between windows and frames. This object is unfortunately also used by some plugins to determine the page origin used for access restrictions. A malicious page could override this object to fool a plugin into granting access to data on another site or the local file system. The behavior of older Firefox versions has been restored.
This flaw does not affect earlier versions of Firefox, or other programs such as Thunderbird or SeaMonkey built on older versions of the browser engine.
References
* https://bugzilla.mozilla.org/show_bug.cgi?id=541530
* CVE-2010-0170
|
|
|
|
|
|
|
|
