CVE-2011-2983

Sažetak

Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products does not properly handle the RegExp.input property, which allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a crafted web site, possibly related to a use-after-free.

Reference

http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html
http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html
http://www.debian.org/security/2011/dsa-2295
http://www.debian.org/security/2011/dsa-2296
http://www.debian.org/security/2011/dsa-2297
http://www.mandriva.com/security/advisories?name=MDVSA-2011:127
http://www.mozilla.org/security/announce/2011/mfsa2011-30.html
http://www.redhat.com/support/errata/RHSA-2011-1164.html
http://www.redhat.com/support/errata/RHSA-2011-1165.html
http://www.redhat.com/support/errata/RHSA-2011-1167.html
http://www.securitytracker.com/id?1025940
https://bugzilla.mozilla.org/show_bug.cgi?id=626297
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14272

CVSS

Base:	4.3
Impact:	2.9
Exploitability:	8.6

Pristup

Vektor	Složenost	Autentikacija
NETWORK	MEDIUM	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	NONE	NONE

CVSS vektor

AV:N/AC:M/Au:N/C:P/I:N/A:N

Zadnje važnije ažuriranje

19-09-2017 - 01:33

Objavljeno

18-08-2011 - 18:55