CVE-2010-1213
Fixed in a distro release EPSS <1%
The importScripts Web Worker method in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not verify that content is valid JavaScript code, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted HTML document.
Products: mozilla firefox, mozilla thunderbird, mozilla seamonkey
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 4 | firefox | 0:3.6.7-2.el4 |
| Red Hat Enterprise Linux 4 | firefox-debuginfo | 0:3.6.7-2.el4 |
| Red Hat Enterprise Linux 5 | firefox | 0:3.6.7-2.el5 |
| Red Hat Enterprise Linux 5 | firefox-debuginfo | 0:3.6.7-2.el5 |
| Red Hat Enterprise Linux 5 | xulrunner | 0:1.9.2.7-2.el5 |
| Red Hat Enterprise Linux 5 | xulrunner-debuginfo | 0:1.9.2.7-2.el5 |
| Red Hat Enterprise Linux 5 | xulrunner-devel | 0:1.9.2.7-2.el5 |
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |