National Cyber Awareness System

Vulnerability Summary for CVE-2010-3775

Overview

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle certain redirections involving data: URLs and Java LiveConnect scripts, which allows remote attackers to start processes, read arbitrary local files, and establish network connections via vectors involving a refresh value in the http-equiv attribute of a META element, which causes the wrong security principal to be used.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.mozilla.org/show_bug.cgi?id=611897

Hyperlink:https://bugzilla.mozilla.org/show_bug.cgi?id=611897

External Source: CONFIRM

Name: https://bugzilla.mozilla.org/show_bug.cgi?id=610525

Hyperlink:https://bugzilla.mozilla.org/show_bug.cgi?id=610525

External Source: CONFIRM

Name: https://bugzilla.mozilla.org/show_bug.cgi?id=589041

Hyperlink:https://bugzilla.mozilla.org/show_bug.cgi?id=589041

External Source: VUPEN

Name: ADV-2011-0030

Hyperlink:http://www.vupen.com/english/advisories/2011/0030

External Source: UBUNTU

Name: USN-1019-1

Hyperlink:http://www.ubuntu.com/usn/USN-1019-1

External Source: SECTRACK

Name: 1024848

Hyperlink:http://www.securitytracker.com/id?1024848

External Source: BID

Name: 45355

Hyperlink:http://www.securityfocus.com/bid/45355

External Source: REDHAT

Name: RHSA-2010:0967

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0967.html

External Source: REDHAT

Name: RHSA-2010:0966

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0966.html

External Source: CONFIRM

Name: http://www.mozilla.org/security/announce/2010/mfsa2010-79.html

Type: Advisory

Hyperlink:http://www.mozilla.org/security/announce/2010/mfsa2010-79.html

External Source: MANDRIVA

Name: MDVSA-2010:251

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:251

External Source: DEBIAN

Name: DSA-2132

Hyperlink:http://www.debian.org/security/2010/dsa-2132

External Source: CONFIRM

Name: http://support.avaya.com/css/P8/documents/100124650

Hyperlink:http://support.avaya.com/css/P8/documents/100124650

External Source: SECUNIA

Name: 42818

Hyperlink:http://secunia.com/advisories/42818

External Source: SECUNIA

Name: 42716

Hyperlink:http://secunia.com/advisories/42716

External Source: OVAL

Name: oval:org.mitre.oval:def:11666

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11666

External Source: SUSE

Name: SUSE-SA:2011:003

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html

External Source: FEDORA

Name: FEDORA-2010-18920

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html

External Source: FEDORA

Name: FEDORA-2010-18890

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html

External Source: FEDORA

Name: FEDORA-2010-18773

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html

External Source: FEDORA

Name: FEDORA-2010-18775

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html

References to Check Content

Identifier:oval:org.mitre.oval:def:11666

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11666