NetSight
IP …
medium4.3

CVE-2010-0182

The XMLDocument::load function in Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4 does not perform th…

Impact

The XMLDocument::load function in Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4 does not perform the expected nsIContentPolicy checks during loading of content by XML documents, which allows attackers to bypass intended access restrictions via crafted content.

Affected products

VendorProductAffected versions
MozillaFirefox
through 3.5.7
Versions 3.6, 0.1, 0.2, 0.3, 0.4
MozillaThunderbird
through 3.0.3
Versions 0.1, 0.2, 0.3, 0.4, 0.5
MozillaSeamonkey
through 2.0.3
Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4

Weakness classification

CWE-20

References