CVE-2010-0172

toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the
asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6
before 3.6.2 does not properly handle concurrent authorization requests
from multiple web sites, which might allow remote web servers to spoof an
authorization dialog and capture credentials by demanding HTTP
authentication in opportunistic circumstances.

Bugs

• <https://bugzilla.mozilla.org/show_bug.cgi?id=537862&gt;