CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS
Percentile
97.5%
Mozilla contributors moz_bug_r_a4, Boris Zbarsky, and Johnny Stenback reported a series of vulnerabilities which allow scripts from page content to run with elevated privileges. moz_bug_r_a4 demonstrated additional variants of MFSA 2007-25 and MFSA2007-35 (arbitrary code execution through XPCNativeWrapper pollution). Additional vulnerabilities reported separately by Boris Zbarsky, Johnny Stenback, and moz_bug_r_a4 showed that the browser could be forced to run JavaScript code using the wrong principal leading to universal XSS and arbitrary code execution.
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1233
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1234
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1235
bugzilla.mozilla.org/buglist.cgi?bug_id=363891,415030,390813
bugzilla.mozilla.org/buglist.cgi?bug_id=384750,387390,411092,411093
bugzilla.mozilla.org/buglist.cgi?bug_id=403167,403168