PT-2006-2926 · Mozilla+4 · Firefox+4
Eric Foley
·
Publicado
2006-04-20
·
Atualizado
2018-10-18
·
CVE-2006-1942
CVSS v2.0
5.1
Média
| Vetor | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions 1.5.0.2 through 1.5.0.4
Netscape versions 7.2, 8.0.4, 8.1
K-Meleon version 0.9.13
Description
The issue allows user-assisted remote attackers to open local files via a web page with an
IMG element containing a SRC attribute with a non-image file:// URL. This can trick the user into selecting View Image for the broken image, potentially launching external applications such as Windows Media Player, or referencing an alternate web page.Recommendations
For Mozilla Firefox versions 1.5.0.2 through 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue.
For Netscape versions 7.2, 8.0.4, 8.1, consider disabling the
IMG element or restricting access to non-image files to minimize the risk of exploitation until a patch is available.
For K-Meleon version 0.9.13, restrict access to the file:// protocol in the SRC attribute of the IMG element to prevent the opening of local files.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Hp-Ux
K-Meleon
Firefox
Netscape
Windows Media Player