Mozilla Foundation Security Advisory 2009-40
Multiple cross origin wrapper bypasses
- Announced
- July 21, 2009
- Reporter
- moz_bug_r_a4
- Impact
- High
- Products
- Firefox
- Fixed in
-
- Firefox 3.0.12
- Firefox 3.5
Description
Mozilla security researcher moz_bug_r_a4 reported
a series of vulnerabilities in which objects that normally receive
a XPCCrossOriginWrapper are constructed without the
wrapper. This can lead to cases where JavaScript from one website may
unsafely access properties of such an object which had been set by a
different website. A malicious website could use this vulnerability
to launch a XSS attack and run arbitrary JavaScript within the context
of another site.
Workaround
Disable JavaScript until a version containing this fix can be installed.