PT-2010-2905 · Mozilla+1 · Firefox+2

Ilja Van Sprundel

·

Publicado

2010-06-22

·

Atualizado

2024-12-12

·

CVE-2010-1197

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.5.x through 3.5.9 Mozilla Firefox versions 3.6.x through 3.6.3 SeaMonkey versions prior to 2.0.5
Description The issue arises when both Content-Disposition: attachment and Content-Type: multipart are present in HTTP headers, allowing remote attackers to conduct cross-site scripting (XSS) attacks via an uploaded HTML document.
Recommendations For Mozilla Firefox versions 3.5.x through 3.5.9, update to version 3.5.10 or later. For Mozilla Firefox versions 3.6.x through 3.6.3, update to version 3.6.4 or later. For SeaMonkey versions prior to 2.0.5, update to version 2.0.5 or later.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-1197
DSA-2064-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
RHSA-2010:0499
RHSA-2010:0500
RHSA-2010:0501
RHSA-2010:0544
RHSA-2010:0545
RHSA-2010_0499
RHSA-2010_0500
RHSA-2010_0501
RHSA-2010_0544
RHSA-2010_0545

Produtos afetados

Firefox
Red Hat
Seamonkey