Privilege escalation through Print Preview — Mozilla

2006-04-1300:00:00

Mozilla Foundation

www.mozilla.org

CVSS2

7.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

EPSS

0.061

Percentile

93.6%

JSON

Georgi Guninski reported two variants of using scripts in an XBL control to gain chrome privileges when the page is viewed under “Print Preview”.

Affected configurations

Vulners

Node

mozillafirefoxRange<1.0.8

mozillafirefoxRange<1.5.0.2

mozillamozilla_suiteRange<1.7.13

mozillaseamonkeyRange<1.0.1

mozillathunderbirdRange<1.0.8

mozillathunderbirdRange<1.5.0.2

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillamozilla_suite*cpe:2.3:a:mozilla:mozilla_suite:*:*:*:*:*:*:*:*
mozillaseamonkey*cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
mozillathunderbird*cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	mozilla_suite	*	cpe:2.3:a:mozilla:mozilla_suite::::::::
mozilla	seamonkey	*	cpe:2.3:a:mozilla:seamonkey::::::::
mozilla	thunderbird	*	cpe:2.3:a:mozilla:thunderbird::::::::