PT-2010-2922

CVE-2010-1215

Published

2010-07-21

Updated

2024-12-12

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.6.x before 3.6.7 Thunderbird versions 3.1.x before 3.1.1

Description The issue arises from improper implementation of access to a content object through a SafeJSObjectWrapper (SJOW) wrapper. This allows remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging access to an object from the chrome scope.

Recommendations For Mozilla Firefox versions 3.6.x before 3.6.7, update to version 3.6.7 or later to resolve the issue. For Thunderbird versions 3.1.x before 3.1.1, update to version 3.1.1 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Moz_Bug_R_A4

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers

CVE-2010-1215