Moz_Bug_R_A4

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 25 Description: The issue allows modification of anonymous content of pluginProblem.xml binding. Recommendations: For versions prior to 25, update to version 25 or later to resolve the issue.

The issue allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site. This is possible because the XrayWrapper implementation does not properly restrict use of DefaultValue for method calls, specifically when a user-defined `toString` or `valueOf` method is triggered.

The issue is related to the improper implementation of the INPUT element in Mozilla Firefox, allowing remote attackers to obtain the full pathname via a crafted web site.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on. This is due to the incorrect context used during the handling of JavaScript code that sets the `location.href` property.

The issue makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site. It also allows remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior. The `nsLocation::CheckURL` function does not properly determine the calling document and principal in its return value.

The issue allows remote attackers to bypass the Same Origin Policy and read the properties of a Location object, or execute arbitrary JavaScript code, via a crafted web site. This is due to a missing security check in the defaultValue function during the unwrapping of security wrappers.

The issue allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, due to the Chrome Object Wrapper (COW) implementation not preventing access to properties of a prototype for a standard class.

The issue is related to the `nsLocation::CheckURL` function, which does not properly follow the security model of the location object. This allows remote attackers to bypass intended content-loading restrictions, possibly having other unspecified impacts via vectors involving chrome code.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, due to insufficient context-menu restrictions for data: URLs compared to javascript: URLs.

The issue is related to the improper implementation of the JavaScript sandbox utility. This allows remote attackers to execute arbitrary JavaScript code with improper privileges via a `javascript:` URL.

The issue allows remote attackers to inject arbitrary web script or HTML via a web page or Firefox extension, due to improper enforcement of XPConnect security restrictions for frame scripts that call untrusted objects.

The issue arises from the JSSubScriptLoader in Mozilla Firefox and Thunderbird, which does not properly handle XPCNativeWrappers during calls to the `loadSubScript` method in an add-on. This makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior.

The issue is related to the `appendChild` function not properly handling DOM objects, allowing remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing of a "dangling pointer."

The issue is related to the event-management implementation, which does not properly select the context for script execution. This allows remote attackers to bypass the Same Origin Policy or execute arbitrary JavaScript code with chrome privileges via a crafted web site.

The issue arises from improper handling of dropping a tab element, allowing remote attackers to execute arbitrary JavaScript code with chrome privileges. This is achieved by establishing a content area and registering for drop events.

The issue is related to the xpinstall functionality in Mozilla Firefox, where the whitelist is not properly enforced. This allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.

The issue arises from the interaction between the XMLHttpRequestSpy object and chrome privileged objects when the XMLHttpRequestSpy module in the Firebug add-on is used. This allows remote attackers to execute arbitrary JavaScript via a crafted HTTP response.

The issue allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function, due to the XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper implementation not properly restricting scripted functions.

The issue arises from improper implementation of access to a content object through a SafeJSObjectWrapper (SJOW) wrapper. This allows remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging access to an object from the chrome scope.

The issue arises from improper handling of interaction between the XMLHttpRequestSpy object and chrome privileged objects when the XMLHttpRequestSpy module in the Firebug add-on is used. This allows remote attackers to execute arbitrary JavaScript via a crafted HTTP response.