CVE-2010-1585
published 2010-04-28CVE-2010-1585: The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14…
PriorityP341critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
4.47%
90.4th percentile
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
Affected
223 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 3.5.16 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Xulrunner vulnerabilities
vendor_ubuntu·2011-04-30
CVE-2011-0077 Xulrunner vulnerabilities
Title: Xulrunner vulnerabilities
Summary: Multiple xulrunner-1.9.1 vulnerabilities
A large number of security issues were discovered in the Gecko rendering
engine. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.
Instructions: After a standard system update you need to restart any applications which
use Xulrunner to make all the necessary changes.
Ubuntu
Firefox and Xulrunner regression
vendor_ubuntu·2011-03-07·CVSS 6.8
[MEDIUM] Firefox and Xulrunner regression
Title: Firefox and Xulrunner regression
Summary: Fixed Java applet regression introduced in the update for USN 1049-1
USN-1049-1 fixed vulnerabilities in Firefox and Xulrunner. That update
introduced a regression where some Java applets would fail to load. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry
Sivonen, Martijn Wargers, David Baron and Marcia Knous discovered several
memory issues in the browser engine. An attacker could exploit these to
crash the browser or possibly run arbitrary code as the user invoking the
program. (CVE-2011-0053, CVE-2011-0062)
Zach Hoffman discovered that a recursive call to eval() wrapped in a
try/catch statement places the browser i
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2011-03-03·CVSS 9.3
CVE-2011-0061 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Thunderbird could be made to crash or run programs as your login if it
opened specially crafted mail.
Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry
Sivonen, Martijn Wargers, David Baron and Marcia Knous discovered several
memory issues in the browser engine. An attacker could exploit these to
crash the browser or possibly run arbitrary code as the user invoking the
program. (CVE-2011-0053, CVE-2011-0062)
Roberto Suggi Liverani discovered a possible issue with unsafe JavaScript
execution in chrome documents. A malicious extension could exploit this to
execute arbitrary code with chrome privlieges. (CVE-2010-1585)
Jordi Chancel discovered a buffer overlow in the JPEG decoding engine. An
attacker could exploit this to
Ubuntu
Firefox and Xulrunner vulnerabilities
vendor_ubuntu·2011-03-03·CVSS 9.3
CVE-2011-0053 [CRITICAL] Firefox and Xulrunner vulnerabilities
Title: Firefox and Xulrunner vulnerabilities
Summary: Multiple browser flaws
Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry
Sivonen, Martijn Wargers, David Baron and Marcia Knous discovered several
memory issues in the browser engine. An attacker could exploit these to
crash the browser or possibly run arbitrary code as the user invoking the
program. (CVE-2011-0053, CVE-2011-0062)
Zach Hoffman discovered that a recursive call to eval() wrapped in a
try/catch statement places the browser into a inconsistent state. An
attacker could exploit this to force a user to accept any dialog.
(CVE-2011-0051)
It was discovered that memory was used after being freed in a method used
by JSON.stringify. An attacker could exploit this to crash the browser or
possibly run arbi
Red Hat
javascript: URLs in chrome documents (MFSA 2011-08)
vendor_redhat·2011-03-01·CVSS 9.3
CVE-2010-1585 [CRITICAL] javascript: URLs in chrome documents (MFSA 2011-08)
javascript: URLs in chrome documents (MFSA 2011-08)
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
Package: firefox (Red Hat Enterprise Linux Extended Update Support 4.8) - Affected
Package: firefox (Red Hat Enterprise Linux Extended Update Support 5.6) - Affected
Package: firefox (Red Hat Ente
GHSA
GHSA-xp93-22jw-4857: The nsIScriptableUnescapeHTML
ghsa_unreviewed·2022-05-14
CVE-2010-1585 [HIGH] CWE-20 GHSA-xp93-22jw-4857: The nsIScriptableUnescapeHTML
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
No detection rules found.
No public exploits indexed.
http://downloads.avaya.com/css/P8/documents/100133195http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/http://www.mandriva.com/security/advisories?name=MDVSA-2011:041http://www.mandriva.com/security/advisories?name=MDVSA-2011:042http://www.mozilla.org/security/announce/2011/mfsa2011-08.htmlhttp://www.security-assessment.com/files/whitepapers/Cross_Context_Scripting_with_Firefox.pdfhttp://www.securityfocus.com/archive/1/510883/100/0/threadedhttps://bugzilla.mozilla.org/show_bug.cgi?id=562547https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12532http://downloads.avaya.com/css/P8/documents/100133195http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/http://www.mandriva.com/security/advisories?name=MDVSA-2011:041http://www.mandriva.com/security/advisories?name=MDVSA-2011:042http://www.mozilla.org/security/announce/2011/mfsa2011-08.htmlhttp://www.security-assessment.com/files/whitepapers/Cross_Context_Scripting_with_Firefox.pdfhttp://www.securityfocus.com/archive/1/510883/100/0/threadedhttps://bugzilla.mozilla.org/show_bug.cgi?id=562547https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12532
2010-04-28
Published