The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7, and SeaMonkey before 2.0.7 does not properly restrict scripted functions, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function.
Project Subscriptions
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-2106-1 | New xulrunner packages fix several vulnerabilities |
Debian DSA |
DSA-2106-2 | New xulrunner packages fix regression |
EUVD |
EUVD-2010-2767 | The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7, and SeaMonkey before 2.0.7 does not properly restrict scripted functions, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function. |
Ubuntu USN |
USN-978-1 | Thunderbird vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2024-08-07T02:46:47.963Z
Reserved: 2010-07-14T00:00:00
Link: CVE-2010-2763
No data.
Status : Deferred
Published: 2010-09-09T19:00:02.313
Modified: 2025-04-11T00:51:21.963
Link: CVE-2010-2763
No data.
OpenCVE Enrichment
No data.
Weaknesses
Debian DSA
EUVD
Ubuntu USN