CVE-2010-0168
The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does n…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Mozilla Firefox 3.6 - Image Preloading Content-Policy Check Security Bypass2010-03-18 · remote · linux · Verified
Impact
The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does not apply scheme restrictions and policy restrictions to the image's URL, which might allow remote attackers to cause a denial of service (application crash or hang) or hijack the functionality of the browser's add-ons via a crafted SRC attribute of an IMG element, as demonstrated by remote command execution through an ssh: URL in a configuration that supports gnome-vfs with a nonstandard network.gnomevfs.supported-protocols setting.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | Versions 3.6, 3.6.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:070
- http://www.mozilla.org/security/announce/2010/mfsa2010-13.html
- http://www.securityfocus.com/bid/38918
- http://www.vupen.com/english/advisories/2010/0692
- https://bugzilla.mozilla.org/show_bug.cgi?id=540642
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8711
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:070
- http://www.mozilla.org/security/announce/2010/mfsa2010-13.html
- http://www.securityfocus.com/bid/38918
- http://www.vupen.com/english/advisories/2010/0692
- https://bugzilla.mozilla.org/show_bug.cgi?id=540642
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8711