CVE-2010-3771

Executive Summary

Informations
Name	CVE-2010-3771	First vendor Publication	2010-12-10
Vendor	Cve	Last vendor Modification	2011-07-18

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle injection of an ISINDEX element into an about:blank page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to redirection to a chrome: URI.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3771

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12343

Oval ID:	oval:org.mitre.oval:def:12343
Title:	Privilege escalation vulnerability in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13 and SeaMonkey before 2.0.11
Description:	Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle injection of an ISINDEX element into an about:blank page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to redirection to a chrome: URI.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2010-3771	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows XP	Product(s):	Mozilla Firefox Mozilla SeaMonkey
Definition Synopsis:
Related to Mozilla Firefox Mozilla Firefox is installed AND Check if the version of Mozilla Firefox is before 3.5.16 or 3.6.x before 3.6.13 OR Related to Mozilla SeaMonkey Mozilla Seamonkey is installed AND Checks for vulnerable versions of Mozilla SeaMonkey Check if the version of Mozilla Seamonkey is before 2.0.11 AND Mozilla Seamonkey before 2.0 is installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mozilla Firefox cpe:/a:mozilla:firefox:3.6.9 cpe:/a:mozilla:firefox:3.6.8 cpe:/a:mozilla:firefox:3.6.7 cpe:/a:mozilla:firefox:3.6.6 cpe:/a:mozilla:firefox:3.6.4 cpe:/a:mozilla:firefox:3.6.3 cpe:/a:mozilla:firefox:3.6.2 cpe:/a:mozilla:firefox:3.6.12 cpe:/a:mozilla:firefox:3.6.11 cpe:/a:mozilla:firefox:3.6.10 cpe:/a:mozilla:firefox:3.6 cpe:/a:mozilla:firefox:3.5.9 cpe:/a:mozilla:firefox:3.5.8 cpe:/a:mozilla:firefox:3.5.7 cpe:/a:mozilla:firefox:3.5.6 cpe:/a:mozilla:firefox:3.5.5 cpe:/a:mozilla:firefox:3.5.4 cpe:/a:mozilla:firefox:3.5.3 cpe:/a:mozilla:firefox:3.5.2 cpe:/a:mozilla:firefox:3.5.15 cpe:/a:mozilla:firefox:3.5.14 cpe:/a:mozilla:firefox:3.5.13 cpe:/a:mozilla:firefox:3.5.12 cpe:/a:mozilla:firefox:3.5.11 cpe:/a:mozilla:firefox:3.5.10 cpe:/a:mozilla:firefox:3.5.1 cpe:/a:mozilla:firefox:3.5 cpe:/a:mozilla:firefox:3.0.9 cpe:/a:mozilla:firefox:3.0.8 cpe:/a:mozilla:firefox:3.0.7 cpe:/a:mozilla:firefox:3.0.6 cpe:/a:mozilla:firefox:3.0.5 cpe:/a:mozilla:firefox:3.0.4 cpe:/a:mozilla:firefox:3.0.3 cpe:/a:mozilla:firefox:3.0.2 cpe:/a:mozilla:firefox:3.0.17 cpe:/a:mozilla:firefox:3.0.16 cpe:/a:mozilla:firefox:3.0.15 cpe:/a:mozilla:firefox:3.0.14 cpe:/a:mozilla:firefox:3.0.13 cpe:/a:mozilla:firefox:3.0.12 cpe:/a:mozilla:firefox:3.0.11 cpe:/a:mozilla:firefox:3.0.10 cpe:/a:mozilla:firefox:3.0.1 cpe:/a:mozilla:firefox:3.0 cpe:/a:mozilla:firefox:2.0.0.9 cpe:/a:mozilla:firefox:2.0.0.8 cpe:/a:mozilla:firefox:2.0.0.7 cpe:/a:mozilla:firefox:2.0.0.6 cpe:/a:mozilla:firefox:2.0.0.5 cpe:/a:mozilla:firefox:2.0.0.4 cpe:/a:mozilla:firefox:2.0.0.3 cpe:/a:mozilla:firefox:2.0.0.20 cpe:/a:mozilla:firefox:2.0.0.2 cpe:/a:mozilla:firefox:2.0.0.19 cpe:/a:mozilla:firefox:2.0.0.18 cpe:/a:mozilla:firefox:2.0.0.17 cpe:/a:mozilla:firefox:2.0.0.16 cpe:/a:mozilla:firefox:2.0.0.15 cpe:/a:mozilla:firefox:2.0.0.14 cpe:/a:mozilla:firefox:2.0.0.13 cpe:/a:mozilla:firefox:2.0.0.12 cpe:/a:mozilla:firefox:2.0.0.11 cpe:/a:mozilla:firefox:2.0.0.10 cpe:/a:mozilla:firefox:2.0.0.1 cpe:/a:mozilla:firefox:2.0 cpe:/a:mozilla:firefox:1.8 cpe:/a:mozilla:firefox:1.5.8 cpe:/a:mozilla:firefox:1.5.7 cpe:/a:mozilla:firefox:1.5.6 cpe:/a:mozilla:firefox:1.5.5 cpe:/a:mozilla:firefox:1.5.4 cpe:/a:mozilla:firefox:1.5.3 cpe:/a:mozilla:firefox:1.5.2 cpe:/a:mozilla:firefox:1.5.1 cpe:/a:mozilla:firefox:1.5.0.9 cpe:/a:mozilla:firefox:1.5.0.8 cpe:/a:mozilla:firefox:1.5.0.7 cpe:/a:mozilla:firefox:1.5.0.6 cpe:/a:mozilla:firefox:1.5.0.5 cpe:/a:mozilla:firefox:1.5.0.4 cpe:/a:mozilla:firefox:1.5.0.3 cpe:/a:mozilla:firefox:1.5.0.2 cpe:/a:mozilla:firefox:1.5.0.12 cpe:/a:mozilla:firefox:1.5.0.11 cpe:/a:mozilla:firefox:1.5.0.10 cpe:/a:mozilla:firefox:1.5.0.1 cpe:/a:mozilla:firefox:1.5:beta2 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.4.1 cpe:/a:mozilla:firefox:1.0.8 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0:preview_release cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.7.1 cpe:/a:mozilla:firefox:0.7 cpe:/a:mozilla:firefox:0.6.1 cpe:/a:mozilla:firefox:0.6 cpe:/a:mozilla:firefox:0.5 cpe:/a:mozilla:firefox:0.4 cpe:/a:mozilla:firefox:0.3 cpe:/a:mozilla:firefox:0.2 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.1	118
Application	Mozilla Seamonkey cpe:/a:mozilla:seamonkey:2.0.9 cpe:/a:mozilla:seamonkey:2.0.8 cpe:/a:mozilla:seamonkey:2.0.7 cpe:/a:mozilla:seamonkey:2.0.6 cpe:/a:mozilla:seamonkey:2.0.5 cpe:/a:mozilla:seamonkey:2.0.4 cpe:/a:mozilla:seamonkey:2.0.3 cpe:/a:mozilla:seamonkey:2.0.2 cpe:/a:mozilla:seamonkey:2.0.10 cpe:/a:mozilla:seamonkey:2.0.1 cpe:/a:mozilla:seamonkey:2.0:rc2 cpe:/a:mozilla:seamonkey:2.0:alpha_3 cpe:/a:mozilla:seamonkey:2.0:alpha_2 cpe:/a:mozilla:seamonkey:2.0:alpha_1 cpe:/a:mozilla:seamonkey:2.0:beta_1 cpe:/a:mozilla:seamonkey:2.0:beta_2 cpe:/a:mozilla:seamonkey:2.0:rc1 cpe:/a:mozilla:seamonkey:2.0 cpe:/a:mozilla:seamonkey:1.5.0.9 cpe:/a:mozilla:seamonkey:1.5.0.8 cpe:/a:mozilla:seamonkey:1.5.0.10 cpe:/a:mozilla:seamonkey:1.1.9 cpe:/a:mozilla:seamonkey:1.1.8 cpe:/a:mozilla:seamonkey:1.1.7 cpe:/a:mozilla:seamonkey:1.1.6 cpe:/a:mozilla:seamonkey:1.1.5 cpe:/a:mozilla:seamonkey:1.1.4 cpe:/a:mozilla:seamonkey:1.1.3 cpe:/a:mozilla:seamonkey:1.1.2 cpe:/a:mozilla:seamonkey:1.1.19 cpe:/a:mozilla:seamonkey:1.1.18 cpe:/a:mozilla:seamonkey:1.1.17 cpe:/a:mozilla:seamonkey:1.1.16 cpe:/a:mozilla:seamonkey:1.1.15 cpe:/a:mozilla:seamonkey:1.1.14 cpe:/a:mozilla:seamonkey:1.1.13 cpe:/a:mozilla:seamonkey:1.1.12 cpe:/a:mozilla:seamonkey:1.1.11 cpe:/a:mozilla:seamonkey:1.1.10 cpe:/a:mozilla:seamonkey:1.1.1 cpe:/a:mozilla:seamonkey:1.1:alpha cpe:/a:mozilla:seamonkey:1.1:beta cpe:/a:mozilla:seamonkey:1.1 cpe:/a:mozilla:seamonkey:1.0.9 cpe:/a:mozilla:seamonkey:1.0.8 cpe:/a:mozilla:seamonkey:1.0.7 cpe:/a:mozilla:seamonkey:1.0.6 cpe:/a:mozilla:seamonkey:1.0.5 cpe:/a:mozilla:seamonkey:1.0.4 cpe:/a:mozilla:seamonkey:1.0.3 cpe:/a:mozilla:seamonkey:1.0.2 cpe:/a:mozilla:seamonkey:1.0.1 cpe:/a:mozilla:seamonkey:1.0 cpe:/a:mozilla:seamonkey:1.0:alpha cpe:/a:mozilla:seamonkey:1.0:beta	55

Open Source Vulnerability Database (OSVDB)

id	Description
69773	Mozilla Multiple Products about:blank Page ISINDEX Element chrome: URI Redire...

Internal Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/45346
CONFIRM	http://support.avaya.com/css/P8/documents/100124650 http://www.mozilla.org/security/announce/2010/mfsa2010-76.html https://bugzilla.mozilla.org/show_bug.cgi?id=609437
DEBIAN	http://www.debian.org/security/2010/dsa-2132
FEDORA	http://lists.fedoraproject.org/pipermail/package-announce/2010-December/05202... http://lists.fedoraproject.org/pipermail/package-announce/2010-December/05203... http://lists.fedoraproject.org/pipermail/package-announce/2010-December/05250... http://lists.fedoraproject.org/pipermail/package-announce/2010-December/05250...
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2010:251
REDHAT	http://www.redhat.com/support/errata/RHSA-2010-0966.html
SECTRACK	http://www.securitytracker.com/id?1024848
SECUNIA	http://secunia.com/advisories/42716 http://secunia.com/advisories/42818
SUSE	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html
UBUNTU	http://www.ubuntu.com/usn/USN-1019-1
VUPEN	http://www.vupen.com/english/advisories/2011/0030

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-10 23:34:30	Multiple Updates

Type	Count
Oval ID(s)	1
CPE ID(s)	173
osvdb(s)	1

Related	Severity
GLSA-201301-01	(Critical)
USN-1019-1	(Critical)
RHSA-2010:0966	(Critical)
MDVSA-2010:251-2	(Critical)
MDVSA-2010:251-1	(Critical)
MDVSA-2010:251	(Critical)
DSA-2132	(Critical)