Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name CVE-2010-0171 First vendor Publication 2010-03-25
Vendor Cve Last vendor Modification 2018-10-30

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0171

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10773
 
Oval ID: oval:org.mitre.oval:def:10773
Title: Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.
Description: Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.
Family: unix Class: vulnerability
Reference(s): CVE-2010-0171
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21486
 
Oval ID: oval:org.mitre.oval:def:21486
Title: RHSA-2010:0153: thunderbird security update (Moderate)
Description: Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.
Family: unix Class: patch
Reference(s): RHSA-2010:0153-02
CESA-2010:0153
CVE-2009-0689
CVE-2009-1571
CVE-2009-2462
CVE-2009-2463
CVE-2009-2466
CVE-2009-2470
CVE-2009-3072
CVE-2009-3075
CVE-2009-3076
CVE-2009-3077
CVE-2009-3274
CVE-2009-3376
CVE-2009-3380
CVE-2009-3384
CVE-2009-3979
CVE-2010-0159
CVE-2010-0163
CVE-2010-0169
CVE-2010-0171
 Version: 250
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22112
 
Oval ID: oval:org.mitre.oval:def:22112
Title: ELSA-2010:0153: thunderbird security update (Moderate)
Description: Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.
Family: unix Class: patch
Reference(s): ELSA-2010:0153-02
CVE-2009-0689
CVE-2009-1571
CVE-2009-2462
CVE-2009-2463
CVE-2009-2466
CVE-2009-2470
CVE-2009-3072
CVE-2009-3075
CVE-2009-3076
CVE-2009-3077
CVE-2009-3274
CVE-2009-3376
CVE-2009-3380
CVE-2009-3384
CVE-2009-3979
CVE-2010-0159
CVE-2010-0163
CVE-2010-0169
CVE-2010-0171
 Version: 81
Platform(s): Oracle Linux 5
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22145
 
Oval ID: oval:org.mitre.oval:def:22145
Title: RHSA-2010:0112: firefox security update (Critical)
Description: Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.
Family: unix Class: patch
Reference(s): RHSA-2010:0112-01
CESA-2010:0112
CVE-2009-1571
CVE-2009-3988
CVE-2010-0159
CVE-2010-0160
CVE-2010-0162
CVE-2010-0167
CVE-2010-0169
CVE-2010-0171
 Version: 107
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22903
 
Oval ID: oval:org.mitre.oval:def:22903
Title: ELSA-2010:0112: firefox security update (Critical)
Description: Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.
Family: unix Class: patch
Reference(s): ELSA-2010:0112-01
CVE-2009-1571
CVE-2009-3988
CVE-2010-0159
CVE-2010-0160
CVE-2010-0162
CVE-2010-0167
CVE-2010-0169
CVE-2010-0171
 Version: 37
Platform(s): Oracle Linux 5
 Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7743
 
Oval ID: oval:org.mitre.oval:def:7743
Title: Mozilla Firefox/Thunderbird/SeaMonkey Multiple Cross Domain Scripting Vulnerabilities
Description: Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.
Family: windows Class: vulnerability
Reference(s): CVE-2010-0171
 Version: 21
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows 7
 Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 19
Application 57
Application 100

OpenVAS Exploits

Date Description
2010-03-30 Name : Mozilla Products Multiple Vulnerabilities Mar-10 (Linux)
File : nvt/secpod_mozilla_prdts_mult_vuln_mar10_lin.nasl
2010-03-30 Name : Mozilla Products Multiple Vulnerabilities Mar-10 (Windows)
File : nvt/secpod_mozilla_prdts_mult_vuln_mar10_win.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
63272 Mozilla Multiple Products Wrapped Object Multiple Function Cross-origin Keyst...

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0112.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0113.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2010-0154.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2010-0153.nasl - Type : ACT_GATHER_INFO
2013-01-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2010-05-11 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2010-0154.nasl - Type : ACT_GATHER_INFO
2010-04-14 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-071.nasl - Type : ACT_GATHER_INFO
2010-03-29 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2010-0153.nasl - Type : ACT_GATHER_INFO
2010-03-23 Name : The remote Windows host contains a web browser that is affected by Multiple V...
File : mozilla_firefox_362.nasl - Type : ACT_GATHER_INFO
2010-03-19 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2010-0154.nasl - Type : ACT_GATHER_INFO
2010-03-02 Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_302.nasl - Type : ACT_GATHER_INFO
2010-02-22 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-042.nasl - Type : ACT_GATHER_INFO
2010-02-18 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : seamonkey_203.nasl - Type : ACT_GATHER_INFO
2010-02-18 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0112.nasl - Type : ACT_GATHER_INFO
2010-02-18 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0113.nasl - Type : ACT_GATHER_INFO
2010-02-18 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0112.nasl - Type : ACT_GATHER_INFO
2010-02-18 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_358.nasl - Type : ACT_GATHER_INFO
2010-02-18 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_3018.nasl - Type : ACT_GATHER_INFO
2010-02-18 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0113.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/38918
CONFIRM http://www.mozilla.org/security/announce/2010/mfsa2010-12.html
https://bugzilla.mozilla.org/show_bug.cgi?id=531364
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
VUPEN http://www.vupen.com/english/advisories/2010/0692

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
Date Informations
2024-02-02 01:12:29
  • Multiple Updates
2024-02-01 12:03:27
  • Multiple Updates
2023-09-05 12:11:43
  • Multiple Updates
2023-09-05 01:03:18
  • Multiple Updates
2023-09-02 12:11:46
  • Multiple Updates
2023-09-02 01:03:20
  • Multiple Updates
2023-08-12 12:13:56
  • Multiple Updates
2023-08-12 01:03:20
  • Multiple Updates
2023-08-11 12:11:49
  • Multiple Updates
2023-08-11 01:03:28
  • Multiple Updates
2023-08-06 12:11:22
  • Multiple Updates
2023-08-06 01:03:22
  • Multiple Updates
2023-08-04 12:11:27
  • Multiple Updates
2023-08-04 01:03:24
  • Multiple Updates
2023-07-14 12:11:23
  • Multiple Updates
2023-07-14 01:03:21
  • Multiple Updates
2023-03-29 01:13:04
  • Multiple Updates
2023-03-28 12:03:27
  • Multiple Updates
2022-10-11 12:10:09
  • Multiple Updates
2022-10-11 01:03:10
  • Multiple Updates
2021-05-04 12:10:59
  • Multiple Updates
2021-04-22 01:11:32
  • Multiple Updates
2020-05-23 01:41:32
  • Multiple Updates
2020-05-23 00:25:07
  • Multiple Updates
2019-06-25 12:02:54
  • Multiple Updates
2019-01-30 12:03:10
  • Multiple Updates
2018-10-31 00:20:01
  • Multiple Updates
2018-07-13 01:03:19
  • Multiple Updates
2017-11-21 12:02:27
  • Multiple Updates
2017-09-19 09:23:35
  • Multiple Updates
2016-06-28 18:00:00
  • Multiple Updates
2016-04-26 19:30:57
  • Multiple Updates
2014-02-17 10:53:20
  • Multiple Updates
2013-05-10 23:16:30
  • Multiple Updates