PT-2005-1251 · Mozilla · Firefox

Omar Khan · Publicado 2005-01-29 · Atualizado 2017-10-11 · CVE-2005-0150

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 1.0

Description The issue allows remote attackers to execute arbitrary code by storing a javascript: or data: URL as a Livefeed bookmark, which is then executed in the security context of the currently loaded page when the user accesses the bookmark.

Recommendations For Firefox versions prior to 1.0, avoid storing javascript: or data: URLs as Livefeed bookmarks to minimize the risk of exploitation. As a temporary workaround, consider restricting access to Livefeed bookmarks until a fix is available.

Correção

Identificadores relacionados

CVE-2005-0150

Produtos afetados

Firefox

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-0150 · Nota de Segurança
• http://mozilla.org/security/announce/mfsa2005-12.html · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100046 · Nota
• http://securityfocus.com/bid/12407 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=265668 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19187 · Nota