Lucene search
HistoryFeb 18, 2010 - 6:00 p.m.
CVE-2010-0654
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
AI Score
8.8
Confidence
High
EPSS
0.006
Percentile
78.2%
Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.
Affected configurations
Node
mozillafirefoxMatch3.5.1
ORmozillafirefoxMatch3.5.2
ORmozillafirefoxMatch3.5.3
ORmozillafirefoxMatch3.5.4
ORmozillafirefoxMatch3.5.5
ORmozillafirefoxMatch3.5.6
ORmozillafirefoxMatch3.5.7
ORmozillafirefoxMatch3.5.9
ORmozillafirefoxMatch3.5.10
ORmozillafirefoxMatch3.6.1
ORmozillafirefoxMatch3.6.2
ORmozillafirefoxMatch3.6.3
ORmozillafirefoxMatch3.6.4
ORmozillafirefoxMatch3.6.6
Node
mozillaseamonkeyRange≤2.0.5
ORmozillaseamonkeyMatch1.0
ORmozillaseamonkeyMatch1.0alpha
ORmozillaseamonkeyMatch1.0beta
ORmozillaseamonkeyMatch1.0.1
ORmozillaseamonkeyMatch1.0.2
ORmozillaseamonkeyMatch1.0.3
ORmozillaseamonkeyMatch1.0.4
ORmozillaseamonkeyMatch1.0.5
ORmozillaseamonkeyMatch1.0.6
ORmozillaseamonkeyMatch1.0.7
ORmozillaseamonkeyMatch1.0.8
ORmozillaseamonkeyMatch1.0.9
ORmozillaseamonkeyMatch1.1
ORmozillaseamonkeyMatch1.1alpha
ORmozillaseamonkeyMatch1.1beta
ORmozillaseamonkeyMatch1.1.1
ORmozillaseamonkeyMatch1.1.2
ORmozillaseamonkeyMatch1.1.3
ORmozillaseamonkeyMatch1.1.4
ORmozillaseamonkeyMatch1.1.5
ORmozillaseamonkeyMatch1.1.6
ORmozillaseamonkeyMatch1.1.7
ORmozillaseamonkeyMatch1.1.8
ORmozillaseamonkeyMatch1.1.9
ORmozillaseamonkeyMatch1.1.10
ORmozillaseamonkeyMatch1.1.11
ORmozillaseamonkeyMatch1.1.12
ORmozillaseamonkeyMatch1.1.13
ORmozillaseamonkeyMatch1.1.14
ORmozillaseamonkeyMatch1.1.15
ORmozillaseamonkeyMatch1.1.16
ORmozillaseamonkeyMatch1.1.17
ORmozillaseamonkeyMatch1.1.18
ORmozillaseamonkeyMatch1.1.19
ORmozillaseamonkeyMatch1.5.0.8
ORmozillaseamonkeyMatch1.5.0.9
ORmozillaseamonkeyMatch1.5.0.10
ORmozillaseamonkeyMatch2.0
ORmozillaseamonkeyMatch2.0alpha_1
ORmozillaseamonkeyMatch2.0alpha_2
ORmozillaseamonkeyMatch2.0alpha_3
ORmozillaseamonkeyMatch2.0beta_1
ORmozillaseamonkeyMatch2.0beta_2
ORmozillaseamonkeyMatch2.0rc1
ORmozillaseamonkeyMatch2.0rc2
ORmozillaseamonkeyMatch2.0.1
ORmozillaseamonkeyMatch2.0.2
ORmozillaseamonkeyMatch2.0.3
ORmozillaseamonkeyMatch2.0.4
ORmozillaseamonkeyMatch2.0a1pre
Node
mozillathunderbirdMatch3.0.1
ORmozillathunderbirdMatch3.0.2
ORmozillathunderbirdMatch3.0.3
ORmozillathunderbirdMatch3.0.4
ORmozillathunderbirdMatch3.0.5
ORmozillathunderbirdMatch3.1
References
code.google.com/p/chromium/issues/detail?id=9877
scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html
websec.sv.cmu.edu/css/css.pdf
www.mozilla.org/security/announce/2010/mfsa2010-46.html
bugzilla.mozilla.org/show_bug.cgi?id=524223
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11811
Related
prion
prion
Design/Logic Flaw
2010-02-18 18:00:00
ubuntucve
ubuntucve
CVE-2010-0654
2010-02-18 00:00:00
mozilla
mozilla
Cross-domain data theft using CSS — Mozilla
2010-07-20 00:00:00
cve
cve
CVE-2010-0654
2010-02-18 18:00:00
cvelist
cvelist
CVE-2010-0654
2010-02-18 17:19:00
veracode
veracode
Information Disclosure
2020-04-10 00:46:02
securityvulns
securityvulns
Mozilla Foundation Security Advisory 2010-46
2010-07-24 00:00:00
Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities
2010-07-24 00:00:00
seebug
seebug
Firefox CSS选择器跨域信息泄露漏洞
2010-07-27 00:00:00
openvas
openvas
Firefox Multiple Vulnerabilities (Feb 2010) - Windows
2010-02-22 00:00:00
Firefox Multiple Vulnerabilities Feb-10 (Linux)
2010-02-22 00:00:00
Firefox Multiple Vulnerabilities Feb-10 (Windows)
2010-02-22 00:00:00
nessus
nessus
Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2010:169)
2010-09-03 00:00:00
openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2010:0430-2)
2010-07-28 00:00:00
openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2010:0430-2)
2014-06-13 00:00:00
ubuntu
ubuntu
Thunderbird vulnerabilities
2010-07-26 00:00:00
Firefox and Xulrunner vulnerabilities
2010-07-23 00:00:00
Firefox and Xulrunner vulnerability
2010-07-26 00:00:00
osv
osv
xulrunner - several vulnerabilities
2010-07-27 00:00:00
xulrunner - several vulnerabilities
2010-11-01 00:00:00
debian
debian
[SECURITY] [DSA 2075-1] New xulrunner packages fix several vulnerabilities
2010-07-27 19:47:37
[SECURITY] [DSA 2124-1] New Xulrunner packages fix several vulnerabilities
2010-11-01 20:38:35
[Backports-security-announce] Security Update for xulrunner
2010-07-21 09:30:16
fedora
fedora
[SECURITY] Fedora 13 Update: thunderbird-3.1.1-1.fc13
2010-07-23 02:48:57
[SECURITY] Fedora 13 Update: sunbird-1.0-0.26.b2pre.fc13
2010-07-23 02:48:57
[SECURITY] Fedora 12 Update: perl-Gtk2-MozEmbed-0.08-6.fc12.14
2010-07-23 02:47:25
oraclelinux
oraclelinux
firefox security update
2010-07-21 00:00:00
centos
centos
firefox, xulrunner security update
2010-07-22 15:29:05
redhat
redhat
(RHSA-2010:0547) Critical: firefox security update
2010-07-20 00:00:00
freebsd
freebsd
mozilla -- multiple vulnerabilities
2010-07-20 00:00:00
suse
suse
remote code execution in MozillaFirefox,MozillaThunderbird,seamonkey
2010-07-30 13:10:04
Firefox update to 31.1esr (important)
2014-09-09 18:04:16
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2013-01-08 00:00:00
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
AI Score
8.8
Confidence
High
EPSS
0.006
Percentile
78.2%
Related for NVD:CVE-2010-0654