PT-2010-1986 · Mozilla · Firefox

Dolske + 1 · Publicado 2010-03-25 · Atualizado 2024-12-12 · CVE-2010-0172

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.2

Description The issue arises from the asynchronous Authorization Prompt implementation in the password manager component, which fails to properly handle concurrent authorization requests from multiple websites. This could potentially allow remote web servers to spoof an authorization dialog, enabling them to capture user credentials by demanding HTTP authentication under certain circumstances.

Recommendations For versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2010-0172

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

Produtos afetados

Firefox

Referências · 2064

• https://suse.com/security/cve/CVE-2023-6856 · Nota
• https://suse.com/security/cve/CVE-2024-4778 · Nota
• https://suse.com/security/cve/CVE-2019-11751 · Nota
• https://suse.com/security/cve/CVE-2017-5441 · Nota
• https://suse.com/security/cve/CVE-2023-6861 · Nota
• https://suse.com/security/cve/CVE-2015-0817 · Nota
• https://suse.com/security/cve/CVE-2021-23965 · Nota
• https://suse.com/security/cve/CVE-2016-9899 · Nota
• https://suse.com/security/cve/CVE-2014-1562 · Nota
• https://suse.com/security/cve/CVE-2015-7176 · Nota
• https://suse.com/security/cve/CVE-2023-32206 · Nota
• https://suse.com/security/cve/CVE-2017-5406 · Nota
• https://suse.com/security/cve/CVE-2016-5272 · Nota
• https://suse.com/security/cve/CVE-2012-3961 · Nota
• https://suse.com/security/cve/CVE-2017-7836 · Nota