Vulnerability Description
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 3.6 |
| Mozilla | Seamonkey | <= 2.0.11 |
| Mozilla | Thunderbird | <= 3.1.7 |
Related Weaknesses (CWE)
References
- http://downloads.avaya.com/css/P8/documents/100133195
- http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsef
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:041
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:042
- http://www.mozilla.org/security/announce/2011/mfsa2011-08.html
- http://www.security-assessment.com/files/whitepapers/Cross_Context_Scripting_witExploit
- http://www.securityfocus.com/archive/1/510883/100/0/threaded
- https://bugzilla.mozilla.org/show_bug.cgi?id=562547
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://downloads.avaya.com/css/P8/documents/100133195
- http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsef
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:041
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:042
- http://www.mozilla.org/security/announce/2011/mfsa2011-08.html
- http://www.security-assessment.com/files/whitepapers/Cross_Context_Scripting_witExploit
FAQ
What is CVE-2010-1585?
CVE-2010-1585 is a vulnerability with a CVSS score of 9.3 (HIGH). The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey be...
How severe is CVE-2010-1585?
CVE-2010-1585 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-1585?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird.