CVE-2010-2762
published 2010-09-09CVE-2010-2762: The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3…
PriorityP432medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
2.02%
79.0th percentile
The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | thunderbird | — | — |
| mozilla | thunderbird | — | — |
| mozilla | thunderbird | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_ubuntu9.3CRITICAL
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox and Xulrunner regression
vendor_ubuntu·2010-09-16·CVSS 9.3
[CRITICAL] Firefox and Xulrunner regression
Title: Firefox and Xulrunner regression
Summary: This update provides stability updates for Firefox and Xulrunner.
USN-975-1 fixed vulnerabilities in Firefox and Xulrunner. Some users
reported stability problems under certain circumstances. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
Several dangling pointer vulnerabilities were discovered in Firefox. An
attacker could exploit this to crash the browser or possibly run arbitrary
code as the user invoking the program. (CVE-2010-2760, CVE-2010-2767,
CVE-2010-3167)
Blake Kaplan and Michal Zalewski discovered several weaknesses in the
XPCSafeJSObjectWrapper (SJOW) security wrapper. If a user were tricked into
viewing a malicious site, a remote attacker could use this to run arbitrary
JavaS
Ubuntu
Firefox and Xulrunner vulnerabilities
vendor_ubuntu·2010-09-08·CVSS 9.3
CVE-2010-2764 [CRITICAL] Firefox and Xulrunner vulnerabilities
Title: Firefox and Xulrunner vulnerabilities
Summary: Firefox could be made to crash or possibly run programs as your login if it
opened a specially crafted file or website.
Several dangling pointer vulnerabilities were discovered in Firefox. An
attacker could exploit this to crash the browser or possibly run arbitrary
code as the user invoking the program. (CVE-2010-2760, CVE-2010-2767,
CVE-2010-3167)
Blake Kaplan and Michal Zalewski discovered several weaknesses in the
XPCSafeJSObjectWrapper (SJOW) security wrapper. If a user were tricked into
viewing a malicious site, a remote attacker could use this to run arbitrary
JavaScript with chrome privileges. (CVE-2010-2762)
Matt Haggard discovered that Firefox did not honor same-origin policy when
processing the statusText property of an X
Red Hat
Mozilla SJOW creates scope chains ending in outer object (MFSA 2010-59)
vendor_redhat·2010-09-07·CVSS 6.8
CVE-2010-2762 [MEDIUM] Mozilla SJOW creates scope chains ending in outer object (MFSA 2010-59)
Mozilla SJOW creates scope chains ending in outer object (MFSA 2010-59)
The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
GHSA
GHSA-hmgm-6jfp-c635: The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3
ghsa_unreviewed·2022-05-17
CVE-2010-2762 [MEDIUM] GHSA-hmgm-6jfp-c635: The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3
The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.
No detection rules found.
No public exploits indexed.
http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefoxhttp://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.htmlhttp://secunia.com/advisories/42867http://support.avaya.com/css/P8/documents/100112690http://www.mandriva.com/security/advisories?name=MDVSA-2010:173http://www.mozilla.org/security/announce/2010/mfsa2010-59.htmlhttp://www.securityfocus.com/bid/43092http://www.vupen.com/english/advisories/2010/2323http://www.vupen.com/english/advisories/2011/0061https://bugzilla.mozilla.org/show_bug.cgi?id=584180https://exchange.xforce.ibmcloud.com/vulnerabilities/61656https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11492http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefoxhttp://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.htmlhttp://secunia.com/advisories/42867http://support.avaya.com/css/P8/documents/100112690http://www.mandriva.com/security/advisories?name=MDVSA-2010:173http://www.mozilla.org/security/announce/2010/mfsa2010-59.htmlhttp://www.securityfocus.com/bid/43092http://www.vupen.com/english/advisories/2010/2323http://www.vupen.com/english/advisories/2011/0061https://bugzilla.mozilla.org/show_bug.cgi?id=584180https://exchange.xforce.ibmcloud.com/vulnerabilities/61656https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11492
2010-09-09
Published