| Description: | Summary:
Mozilla Firefox is prone to multiple vulnerabilities.
Vulnerability Insight:
The following flaws exist:
- PreserveWrapper does not handle lack of wrapper
- Error in processing of SVG format images with filters to read pixel values
- Does not prevent inclusion of body data in XMLHttpRequest HEAD request
- Multiple unspecified vulnerabilities in the browser engine
- Does not properly handle onreadystatechange events in conjunction with page reloading
- Profiler parses untrusted data during UI rendering
- System Only Wrapper (SOW) and Chrome Object Wrapper (COW), does not restrict XBL user-defined
functions
- Use-after-free vulnerability in 'nsIDocument::GetRootElement' and
'mozilla::dom::HTMLMediaElement::LookupMediaElementURITable' functions
- Multiple unspecified vulnerabilities in the browser engine
- Internationalized Domain Name (IDN) does not properly handle the .com, .name, and .net top-level
domains
- Does not properly implement DocShell inheritance behavior for sandbox attribute of an IFRAME
element
- 'getUserMedia' permission references the URL of top-level document instead of a specific page
- XrayWrapper does not properly restrict use of DefaultValue for method calls
- Does not properly enforce the X-Frame-Options protection mechanism
- Crash @xul!nsDOMEvent::GetTargetFromFrame on poison value
Vulnerability Impact:
Successful exploitation will allow attackers to execute arbitrary
code, obtain potentially sensitive information, gain escalated privileges, bypass security
restrictions, and perform unauthorized actions. Other attacks may also be possible.
Affected Software/OS:
Mozilla Firefox before version 22.0 on Mac OS X.
Solution:
Update to version 22.0 or later.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
