PT-2005-3198 · Mozilla+2 · Firefox+3
John Dalbec
·
Publicado
2005-07-13
·
Atualizado
2017-10-11
·
CVE-2005-2269
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Firefox versions prior to 1.0.5
Mozilla versions prior to 1.7.9
Netscape version 8.0.2
Description:
The issue arises from improper verification of DOM node names within their namespaces, allowing remote attackers to modify certain tag properties. This could lead to the execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags that have custom properties, a technique known as "XHTML node spoofing".
Recommendations:
For Firefox versions prior to 1.0.5, update to version 1.0.5 or later.
For Mozilla versions prior to 1.7.9, update to version 1.7.9 or later.
For Netscape version 8.0.2, consider disabling the use of custom properties in IMG tags as a temporary workaround until a patch is available.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Firefox
Mozilla Firefox
Netscape
Red Hat