CVE-2010-2762

CVSS v2.0 6.8 (Medium)

EPSS 1.44 % (87^th)

Affected Products 2

Advisories 4

The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.

Weaknesses

CWE-264: Permissions, Privileges, and Access Controls

CVE Status: PUBLISHED
CNA: MITRE
Published Date: 2010-09-09 19:00:02
(14 years ago)
Updated Date: 2017-09-19 01:31:07
(7 years ago)

Affected Products

Mozilla

Configuration #1

		CPE23	From	Up To
	Mozilla Firefox 3.6	cpe:2.3:a:mozilla:firefox:3.6
	Mozilla Firefox 3.6.2	cpe:2.3:a:mozilla:firefox:3.6.2
	Mozilla Firefox 3.6.3	cpe:2.3:a:mozilla:firefox:3.6.3
	Mozilla Firefox 3.6.4	cpe:2.3:a:mozilla:firefox:3.6.4
	Mozilla Firefox 3.6.6	cpe:2.3:a:mozilla:firefox:3.6.6
	Mozilla Firefox 3.6.7	cpe:2.3:a:mozilla:firefox:3.6.7
	Mozilla Firefox 3.6.8	cpe:2.3:a:mozilla:firefox:3.6.8

Configuration #2

		CPE23	From	Up To
	Mozilla Thunderbird 3.1	cpe:2.3:a:mozilla:thunderbird:3.1
	Mozilla Thunderbird 3.1.1	cpe:2.3:a:mozilla:thunderbird:3.1.1
	Mozilla Thunderbird 3.1.2	cpe:2.3:a:mozilla:thunderbird:3.1.2