Vulnerability Description
The layout engine in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 executes different code for visited and unvisited links during the processing of Cascading Style Sheets (CSS) token sequences, which makes it easier for remote attackers to obtain sensitive information about visited web pages via a timing attack.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | <= 3.6.24 |
| Mozilla | Thunderbird | <= 3.1.16 |
| Mozilla | Seamonkey | <= 2.1 |
Related Weaknesses (CWE)
References
- http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
FAQ
What is CVE-2010-5074?
CVE-2010-5074 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The layout engine in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 executes different code for visited and unvisited links during the processing of Cascading Style Sheet...
How severe is CVE-2010-5074?
CVE-2010-5074 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-5074?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Thunderbird, Mozilla Seamonkey.