[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2010-0654Date: (C)2010-02-18   (M)2024-03-27


Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 4.3
Exploit Score: 8.6
Impact Score: 2.9
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: PARTIAL
Integrity: NONE
Availability: NONE
  
Reference:
http://code.google.com/p/chromium/issues/detail?id=9877
http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html
http://websec.sv.cmu.edu/css/css.pdf
http://www.mozilla.org/security/announce/2010/mfsa2010-46.html
https://bugzilla.mozilla.org/show_bug.cgi?id=524223
oval:org.mitre.oval:def:11811

CPE    69
cpe:/a:mozilla:firefox:3.5.7
cpe:/a:mozilla:firefox:3.5.5
cpe:/a:mozilla:firefox:3.5.6
cpe:/a:mozilla:firefox:3.5.9
...
CWE    1
CWE-200
OVAL    36
oval:org.secpod.oval:def:600096
oval:org.secpod.oval:def:300157
oval:org.secpod.oval:def:700045
oval:org.secpod.oval:def:100519
...

© SecPod Technologies