PT-2011-4229 · Mozilla · Firefox+1

Publicado 2011-08-16 · Atualizado 2024-12-12 · CVE-2011-2990

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 5 SeaMonkey versions 2.x before 2.3

Description The issue is related to the implementation of Content Security Policy (CSP) violation reports, which does not properly remove proxy-authorization credentials from the listed request headers. This allows attackers to obtain sensitive information by reading a report. The problem is associated with incorrect host resolution that occurs with certain redirects.

Recommendations For Mozilla Firefox versions 4.x through 5, update to a version that properly handles CSP violation reports. For SeaMonkey versions 2.x before 2.3, update to version 2.3 or later to ensure correct handling of CSP violation reports.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2011-2990

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

Produtos afetados

Firefox

Seamonkey

Referências · 2066

• https://suse.com/security/cve/CVE-2023-6856 · Nota
• https://suse.com/security/cve/CVE-2024-4778 · Nota
• https://suse.com/security/cve/CVE-2019-11751 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2990 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-5441 · Nota
• https://suse.com/security/cve/CVE-2023-6861 · Nota
• https://suse.com/security/cve/CVE-2015-0817 · Nota
• https://suse.com/security/cve/CVE-2021-23965 · Nota
• https://suse.com/security/cve/CVE-2016-9899 · Nota
• https://suse.com/security/cve/CVE-2014-1562 · Nota
• https://suse.com/security/cve/CVE-2015-7176 · Nota
• https://suse.com/security/cve/CVE-2023-32206 · Nota
• https://suse.com/security/cve/CVE-2017-5406 · Nota
• https://suse.com/security/cve/CVE-2016-5272 · Nota
• https://suse.com/security/cve/CVE-2012-3961 · Nota