Lucene search
HistoryApr 05, 2010 - 5:30 p.m.
CVE-2010-0178
CVSS2
7.6
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
AI Score
7.2
Confidence
Low
EPSS
0.022
Percentile
89.4%
Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4, does not prevent applets from interpreting mouse clicks as drag-and-drop actions, which allows remote attackers to execute arbitrary JavaScript with Chrome privileges by loading a chrome: URL and then loading a javascript: URL.
Affected configurations
Node
mozillafirefoxMatch3.5
ORmozillafirefoxMatch3.5.1
ORmozillafirefoxMatch3.5.2
ORmozillafirefoxMatch3.5.3
ORmozillafirefoxMatch3.5.4
ORmozillafirefoxMatch3.5.5
ORmozillafirefoxMatch3.5.6
ORmozillafirefoxMatch3.5.7
Node
mozillafirefoxMatch3.6
Node
mozillafirefoxRange≤3.0.17
ORmozillafirefoxMatch0.1
ORmozillafirefoxMatch0.2
ORmozillafirefoxMatch0.3
ORmozillafirefoxMatch0.4
ORmozillafirefoxMatch0.5
ORmozillafirefoxMatch0.6
ORmozillafirefoxMatch0.6.1
ORmozillafirefoxMatch0.7
ORmozillafirefoxMatch0.7.1
ORmozillafirefoxMatch0.8
ORmozillafirefoxMatch0.9
ORmozillafirefoxMatch0.9rc
ORmozillafirefoxMatch0.9.1
ORmozillafirefoxMatch0.9.2
ORmozillafirefoxMatch0.9.3
ORmozillafirefoxMatch0.10
ORmozillafirefoxMatch0.10.1
ORmozillafirefoxMatch1.0
ORmozillafirefoxMatch1.0preview_release
ORmozillafirefoxMatch1.0.1
ORmozillafirefoxMatch1.0.2
ORmozillafirefoxMatch1.0.3
ORmozillafirefoxMatch1.0.4
ORmozillafirefoxMatch1.0.5
ORmozillafirefoxMatch1.0.6
ORmozillafirefoxMatch1.0.7
ORmozillafirefoxMatch1.0.8
ORmozillafirefoxMatch1.5
ORmozillafirefoxMatch1.5beta1
ORmozillafirefoxMatch1.5beta2
ORmozillafirefoxMatch1.5.0.1
ORmozillafirefoxMatch1.5.0.2
ORmozillafirefoxMatch1.5.0.3
ORmozillafirefoxMatch1.5.0.4
ORmozillafirefoxMatch1.5.0.5
ORmozillafirefoxMatch1.5.0.6
ORmozillafirefoxMatch1.5.0.7
ORmozillafirefoxMatch1.5.0.8
ORmozillafirefoxMatch1.5.0.9
ORmozillafirefoxMatch1.5.0.10
ORmozillafirefoxMatch1.5.0.11
ORmozillafirefoxMatch1.5.0.12
ORmozillafirefoxMatch1.5.1
ORmozillafirefoxMatch1.5.2
ORmozillafirefoxMatch1.5.3
ORmozillafirefoxMatch1.5.4
ORmozillafirefoxMatch1.5.5
ORmozillafirefoxMatch1.5.6
ORmozillafirefoxMatch1.5.7
ORmozillafirefoxMatch1.5.8
ORmozillafirefoxMatch2.0
ORmozillafirefoxMatch2.0.0.1
ORmozillafirefoxMatch2.0.0.2
ORmozillafirefoxMatch2.0.0.3
ORmozillafirefoxMatch2.0.0.4
ORmozillafirefoxMatch2.0.0.5
ORmozillafirefoxMatch2.0.0.6
ORmozillafirefoxMatch2.0.0.7
ORmozillafirefoxMatch2.0.0.8
ORmozillafirefoxMatch2.0.0.9
ORmozillafirefoxMatch2.0.0.10
ORmozillafirefoxMatch2.0.0.11
ORmozillafirefoxMatch2.0.0.12
ORmozillafirefoxMatch2.0.0.13
ORmozillafirefoxMatch2.0.0.14
ORmozillafirefoxMatch2.0.0.15
ORmozillafirefoxMatch2.0.0.16
ORmozillafirefoxMatch2.0.0.17
ORmozillafirefoxMatch2.0.0.18
ORmozillafirefoxMatch2.0.0.19
ORmozillafirefoxMatch2.0.0.20
ORmozillafirefoxMatch3.0
ORmozillafirefoxMatch3.0.1
ORmozillafirefoxMatch3.0.2
ORmozillafirefoxMatch3.0.3
ORmozillafirefoxMatch3.0.4
ORmozillafirefoxMatch3.0.5
ORmozillafirefoxMatch3.0.6
ORmozillafirefoxMatch3.0.7
ORmozillafirefoxMatch3.0.8
ORmozillafirefoxMatch3.0.9
ORmozillafirefoxMatch3.0.10
ORmozillafirefoxMatch3.0.11
ORmozillafirefoxMatch3.0.12
ORmozillafirefoxMatch3.0.13
ORmozillafirefoxMatch3.0.14
ORmozillafirefoxMatch3.0.15
ORmozillafirefoxMatch3.0.16
Node
mozillaseamonkeyRange≤2.0.3
ORmozillaseamonkeyMatch1.0
ORmozillaseamonkeyMatch1.0alpha
ORmozillaseamonkeyMatch1.0beta
ORmozillaseamonkeyMatch1.0.1
ORmozillaseamonkeyMatch1.0.2
ORmozillaseamonkeyMatch1.0.3
ORmozillaseamonkeyMatch1.0.4
ORmozillaseamonkeyMatch1.0.5
ORmozillaseamonkeyMatch1.0.6
ORmozillaseamonkeyMatch1.0.7
ORmozillaseamonkeyMatch1.0.8
ORmozillaseamonkeyMatch1.0.9
ORmozillaseamonkeyMatch1.1
ORmozillaseamonkeyMatch1.1alpha
ORmozillaseamonkeyMatch1.1beta
ORmozillaseamonkeyMatch1.1.1
ORmozillaseamonkeyMatch1.1.2
ORmozillaseamonkeyMatch1.1.3
ORmozillaseamonkeyMatch1.1.4
ORmozillaseamonkeyMatch1.1.5
ORmozillaseamonkeyMatch1.1.6
ORmozillaseamonkeyMatch1.1.7
ORmozillaseamonkeyMatch1.1.8
ORmozillaseamonkeyMatch1.1.9
ORmozillaseamonkeyMatch1.1.10
ORmozillaseamonkeyMatch1.1.11
ORmozillaseamonkeyMatch1.1.12
ORmozillaseamonkeyMatch1.1.13
ORmozillaseamonkeyMatch1.1.14
ORmozillaseamonkeyMatch1.1.15
ORmozillaseamonkeyMatch1.1.16
ORmozillaseamonkeyMatch1.1.17
ORmozillaseamonkeyMatch1.1.18
ORmozillaseamonkeyMatch1.1.19
ORmozillaseamonkeyMatch2.0
ORmozillaseamonkeyMatch2.0alpha_1
ORmozillaseamonkeyMatch2.0alpha_2
ORmozillaseamonkeyMatch2.0alpha_3
ORmozillaseamonkeyMatch2.0beta_1
ORmozillaseamonkeyMatch2.0beta_2
ORmozillaseamonkeyMatch2.0rc1
ORmozillaseamonkeyMatch2.0rc2
ORmozillaseamonkeyMatch2.0.1
ORmozillaseamonkeyMatch2.0.2
ORmozillaseamonkeyMatch2.0.4
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mozilla | firefox | 3.5 | cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:* |
| mozilla | firefox | 3.5.1 | cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:* |
| mozilla | firefox | 3.5.2 | cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:* |
| mozilla | firefox | 3.5.3 | cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:* |
| mozilla | firefox | 3.5.4 | cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:* |
| mozilla | firefox | 3.5.5 | cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:* |
| mozilla | firefox | 3.5.6 | cpe:2.3:a:mozilla:firefox:3.5.6:*:*:*:*:*:*:* |
| mozilla | firefox | 3.5.7 | cpe:2.3:a:mozilla:firefox:3.5.7:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6 | cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:* |
| mozilla | firefox | * | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
References
lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
secunia.com/advisories/39136
secunia.com/advisories/39240
secunia.com/advisories/39243
secunia.com/advisories/39308
secunia.com/advisories/39397
securitytracker.com/id?1023776
ubuntu.com/usn/usn-921-1
www.debian.org/security/2010/dsa-2027
www.mandriva.com/security/advisories?name=MDVSA-2010:070
www.mozilla.org/security/announce/2010/mfsa2010-20.html
www.redhat.com/support/errata/RHSA-2010-0332.html
www.vupen.com/english/advisories/2010/0748
www.vupen.com/english/advisories/2010/0764
www.vupen.com/english/advisories/2010/0781
www.vupen.com/english/advisories/2010/0849
bugzilla.mozilla.org/show_bug.cgi?id=546909
exchange.xforce.ibmcloud.com/vulnerabilities/57391
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10460
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6975
Related
prion
prion
Code injection
2010-04-05 17:30:00
mozilla
mozilla
Chrome privilege escalation via forced URL drag and drop — Mozilla
2010-03-30 00:00:00
veracode
veracode
Arbitrary JavaScript Code Execution
2020-04-10 00:45:25
cve
cve
CVE-2010-0178
2010-04-05 17:30:00
seebug
seebug
Mozilla Firefox浏览器强制URL拖放操作权限提升漏洞
2010-04-08 00:00:00
ubuntucve
ubuntucve
CVE-2010-0178
2010-04-05 00:00:00
securityvulns
securityvulns
Mozilla Foundation Security Advisory 2010-20
2010-04-06 00:00:00
xulrunner multiple security vulnerabilities
2010-04-06 00:00:00
[SECURITY] [DSA 2027-1] New xulrunner packages fix several vulnerabilities
2010-04-06 00:00:00
cvelist
cvelist
CVE-2010-0178
2010-04-05 17:00:00
openvas
openvas
Mozilla Products Multiple vulnerabilities apr-10 (Windows)
2010-04-13 00:00:00
Mozilla Products Multiple Vulnerabilities (Apr 2010) - Windows
2010-04-13 00:00:00
Debian: Security Advisory (DSA-2027-1)
2010-04-21 00:00:00
nessus
nessus
Debian DSA-2027-1 : xulrunner - several vulnerabilities
2010-04-05 00:00:00
Scientific Linux Security Update : firefox on SL4.x i386/x86_64
2012-08-01 00:00:00
RHEL 4 / 5 : firefox (RHSA-2010:0332)
2010-05-11 00:00:00
redhat
redhat
(RHSA-2010:0332) Critical: firefox security update
2010-03-30 00:00:00
centos
centos
firefox security update
2010-04-06 21:01:59
debian
debian
[SECURITY] [DSA 2027-1] New xulrunner packages fix several vulnerabilities
2010-04-03 17:50:19
[Backports-security-announce] Security Update for xulrunner
2010-07-01 11:48:42
[Backports-security-announce] Security Update for xulrunner
2010-07-01 11:54:27
osv
osv
xulrunner - several vulnerabilities
2010-04-03 00:00:00
oraclelinux
oraclelinux
firefox security update
2010-03-31 00:00:00
ubuntu
ubuntu
Firefox 3.0 and Xulrunner vulnerabilities
2010-04-09 00:00:00
Firefox 3.5 and Xulrunner vulnerabilities
2010-04-09 00:00:00
fedora
fedora
[SECURITY] Fedora 11 Update: hulahop-0.4.9-13.fc11
2010-04-01 01:49:04
[SECURITY] Fedora 11 Update: gnome-web-photo-0.7-11.fc11
2010-04-01 01:49:04
[SECURITY] Fedora 12 Update: Miro-2.5.4-3.fc12
2010-04-01 01:45:23
freebsd
freebsd
mozilla -- multiple vulnerabilities
2010-03-30 00:00:00
suse
suse
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2013-01-08 00:00:00
CVSS2
7.6
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
AI Score
7.2
Confidence
Low
EPSS
0.022
Percentile
89.4%
Related for NVD:CVE-2010-0178