NetSight
IP …
medium4.3

CVE-2010-1197

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition:…

Impact

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an uploaded HTML document.

Affected products

VendorProductAffected versions
MozillaFirefox
Versions 3.5, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5
MozillaSeamonkey
through 2.0.4
Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4

Weakness classification

CWE-79

References