medium5.0
CVE-2011-2370
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation di…
Impact
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | through 4.0.1 Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-28.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=645699
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14278
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-28.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=645699
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14278