Vulnerabilities

Mozilla Firefox 2.x before 2.0.0.19 remote vulnerability (PC1-2008-1172)

Overview

Vulnerability chart	Risk level Low Medium High Extreme Severe Warning: security vulnerability level = severe 70 vulnerabilities(-y) found between 17 September, 2004 and 20 July, 2009. Mozilla Firefox is identified as a web browser moved down from the Mozilla... more See also: Firefox 2, mozilla-firefox, Mozilla JavaScript, The Mozilla JavaScript, Mozilla-based 30 files found: FirefoxSetu..., nsBookmarkT..., nsSessionStartup.js, nsSetDefaultBrowser.js, nsSessionStore.js, FeedProcessor.js, nsUrlClassi..., firefox.js, firefox-branding.js, reporter.js, nsSafebrows..., FeedWriter.js, nsUrlClassi..., nsURLFormatter.js, FeedConverter.js... more A vulnerability in Mozilla Firefox 2.x before 2.0.0.19 was identified.
Remote Access Unknown patch availability Patch implementation unknown

References to Advisories, Solutions, and Tools

Description:

By running the vulnerability found in Mozilla Firefox 2.x before 2.0.0.19, remote attackers are able to run arbitrary JavaScript with chrome rights through vectors associated with the feed preview.

Impact:

By running the vulnerability identified in Mozilla Firefox 2.x before 2.0.0.19, remote attackers may gain administrator access. This vulnerability also offers partial confidentiality, integrity, and availability violation. Moreover, the information can be revealed and changes can be made without any authorization. With the help of this vulnerability, a service can be broken up.

References:

https://bugzilla.mozilla.org/show_bug.cgi?id=453526
http://www.mozilla.org/security/announce/2008/mfsa2008-62.html

Impact

CVSS Severity		CVSS Version 2 Metrics:
CVSS v2 Base Score:	7.5 (HIGH)	Access Vector:	N/A
Impact Subscore:	6.4	Access Complexity:	Low
Exploitability Subscore:	10.0	Authentication:	Not required to exploit
		Impact Type:	Provides unauthorized access, Allows partial confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service