CVE-2011-2981

Sažetak

The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the context for script to run in, which allows remote attackers to bypass the Same Origin Policy or execute arbitrary JavaScript code with chrome privileges via a crafted web site.

Reference

http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html
http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html
http://www.debian.org/security/2011/dsa-2295
http://www.debian.org/security/2011/dsa-2296
http://www.debian.org/security/2011/dsa-2297
http://www.mandriva.com/security/advisories?name=MDVSA-2011:127
http://www.mozilla.org/security/announce/2011/mfsa2011-30.html
http://www.redhat.com/support/errata/RHSA-2011-1164.html
https://bugzilla.mozilla.org/show_bug.cgi?id=614151
https://bugzilla.mozilla.org/show_bug.cgi?id=643450
https://bugzilla.mozilla.org/show_bug.cgi?id=650252
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14512

CVSS

Base:	9.3
Impact:	10.0
Exploitability:	8.6

Pristup

Vektor	Složenost	Autentikacija
NETWORK	MEDIUM	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
COMPLETE	COMPLETE	COMPLETE

CVSS vektor

AV:N/AC:M/Au:N/C:C/I:C/A:C

Zadnje važnije ažuriranje

19-09-2017 - 01:33

Objavljeno

18-08-2011 - 18:55