PT-2011-4229 · Mozilla · Firefox+1

Published 2011-08-16 · Updated 2024-12-12 · CVE-2011-2990

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 5 SeaMonkey versions 2.x before 2.3

Description The issue is related to the implementation of Content Security Policy (CSP) violation reports, which does not properly remove proxy-authorization credentials from the listed request headers. This allows attackers to obtain sensitive information by reading a report. The problem is associated with incorrect host resolution that occurs with certain redirects.

Recommendations For Mozilla Firefox versions 4.x through 5, update to a version that properly handles CSP violation reports. For SeaMonkey versions 2.x before 2.3, update to version 2.3 or later to ensure correct handling of CSP violation reports.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2011-2990

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

Affected Products

Firefox

Seamonkey

References · 2066

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2990 · Security Note
• http://mozilla.org/security/announce/2011/mfsa2011-29.html · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2011-29 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2990 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html · Vendor Advisory
• https://suse.com/security/cve/CVE-2023-6856 · Note
• https://suse.com/security/cve/CVE-2024-4778 · Note
• https://suse.com/security/cve/CVE-2019-11751 · Note
• https://suse.com/security/cve/CVE-2017-5441 · Note
• https://suse.com/security/cve/CVE-2023-6861 · Note
• https://suse.com/security/cve/CVE-2015-0817 · Note
• https://suse.com/security/cve/CVE-2021-23965 · Note
• https://suse.com/security/cve/CVE-2016-9899 · Note