Fluid Attacks Database

Description

Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a file that has already been saved on the local system.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	devhelp	<0:0.12-20.el5	0:0.12-20.el5
rpm rhel5	firefox	<0:3.0.4-1.el5	0:3.0.4-1.el5
rpm rhel5	nss	<0:3.12.1.1-3.el5	0:3.12.1.1-3.el5
rpm rhel5	xulrunner	<0:1.9.0.4-1.el5	0:1.9.0.4-1.el5
rpm rhel5	yelp	<0:2.16.0-22.el5	0:2.16.0-22.el5

Aliases

1. CVE-2008-50152. NVD-2008-50153. OSV-2008-5015

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.