 |
|
|
|
| From: | MOZILLA | | Date: | 23.10.2010 | | Subject: | Mozilla Foundation Security Advisory 2010-68 |
Mozilla Foundation Security Advisory 2010-68
Title: XSS in gopher parser when parsing hrefs
Impact: High
Announced: October 19, 2010
Reporter: Robert Swiecki
Products: Firefox, SeaMonkey
Fixed in: Firefox 3.6.11
Firefox 3.5.14
SeaMonkey 2.0.9
Description
Google security researcher Robert Swiecki reported that functions used by the Gopher parser to convert text to HTML tags could be exploited to turn text into executable JavaScript. If an attacker could create a file or directory on a Gopher server with the encoded script as part of its name the script would then run in a victim's browser within the context of the site.
References
* https://bugzilla.mozilla.org/show_bug.cgi?id=556734
* CVE-2010-3177
|
|
|
|
|
|
|
|
