Mozilla

Mozilla

Mozilla Foundation Security Advisory 2013-112

Linux clipboard information disclosure though selection paste

Announced
December 10, 2013
Reporter
Vincent Lefevre
Impact
Low
Products
Firefox, SeaMonkey
Fixed in
  • Firefox 26
  • SeaMonkey 2.23

Description

Mozilla community member Vincent Lefevre reported that on Linux systems, web content can access data saved to the clipboard when a user attempts to paste a selection with a middle-click instead of pasting the selection content. This allows for possibly private data in the clipboard to be inadvertently disclosed to web content. Windows and OS X systems are not affected by this issue.

In general these flaws cannot be exploited through email in the Thunderbird and Seamonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts.

References