Ubuntu.comUB:CVE-2009-0356CVE-2009-0356
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS
Percentile
96.3%
Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1)
about:plugins and (2) about:config URIs from .desktop files, which allows
user-assisted remote attackers to bypass the Same Origin Policy and execute
arbitrary code with chrome privileges via vectors involving the URL field
in a Desktop Entry section of a .desktop file, related to representation of
about: URIs as jar:file:// URIs. NOTE: this issue exists because of an
incomplete fix for CVE-2008-4582.
Notes
| Author | Note |
|---|---|
| jdstrand | not a linux issue per asac |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS
Percentile
96.3%