Mozilla Foundation Security Advisory 2010-79

Mozilla Foundation Security Advisory 2010-79

Title: Java security bypass from LiveConnect loaded via data: URL meta refresh
Impact: Critical
Announced: December 9, 2010
Reporter: Gregory Fleischer
Products: Firefox, SeaMonkey

Fixed in: Firefox 3.6.13
Firefox 3.5.16
SeaMonkey 2.0.11
Description

Security researcher Gregory Fleischer reported that when a Java LiveConnect script was loaded via a data: URL which redirects via a meta refresh, then the resulting plugin object was created with the wrong security principal and thus received elevated privileges such as the abilities to read local files, launch processes, and create network connections.
References

* Java LiveConnect bugs
* CVE-2010-3775