PT-2010-1986 · Mozilla · Firefox

Dolske + 1 · Published 2010-03-25 · Updated 2024-12-12 · CVE-2010-0172

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.2

Description The issue arises from the asynchronous Authorization Prompt implementation in the password manager component, which fails to properly handle concurrent authorization requests from multiple websites. This could potentially allow remote web servers to spoof an authorization dialog, enabling them to capture user credentials by demanding HTTP authentication under certain circumstances.

Recommendations For versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2010-0172

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

Affected Products

Firefox

References · 2064

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://mozilla.org/security/announce/2010/mfsa2010-15.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-0172 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:070 · Vendor Advisory
• https://suse.com/security/cve/CVE-2023-6856 · Note
• https://suse.com/security/cve/CVE-2024-4778 · Note
• https://suse.com/security/cve/CVE-2019-11751 · Note
• https://suse.com/security/cve/CVE-2017-5441 · Note
• https://suse.com/security/cve/CVE-2023-6861 · Note
• https://suse.com/security/cve/CVE-2015-0817 · Note
• https://suse.com/security/cve/CVE-2021-23965 · Note
• https://suse.com/security/cve/CVE-2016-9899 · Note
• https://suse.com/security/cve/CVE-2014-1562 · Note
• https://suse.com/security/cve/CVE-2015-7176 · Note