Mozilla

Mozilla

Mozilla Foundation Security Advisory 2013-72

Wrong principal used for validating URI for some Javascript components

Announced
August 6, 2013
Reporter
Cody Crews
Impact
High
Products
Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR
Fixed in
  • Firefox 23
  • Firefox ESR 17.0.8
  • SeaMonkey 2.20
  • Thunderbird 17.0.8
  • Thunderbird ESR 17.0.8

Description

Security researcher Cody Crews reported that some Javascript components will perform checks against the wrong uniform resource identifier (URI) before performing security sensitive actions. This will return an incorrect location for the originator of the call. This could be used to bypass same-origin policy, allowing for cross-site scripting (XSS) or the installation of malicious add-ons from third-party pages.

In general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled, but are potentially a risk in browser or browser-like contexts.

References