You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2009-19

Mozilla Foundation Security Advisory 2009-19

Title: Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString
Impact: High
Announced: April 21, 2009
Reporter: moz_bug_r_a4
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.0.9


Mozilla security researcher moz_bug_r_a4 reported that it is possible to create a document whose URI does not match the document's principal using XMLHttpRequest. This type of mismatch leads to incorrect results in principal-based security checks. An attacker could use this vulnerability to execute arbitrary JavaScript within the context of another site.

moz_bug_r_a4 separately reported that XPCNativeWrapper.toString's __proto__ comes from the wrong scope which results in calls to that function being executed in the wrong context in certain circumstances. An attacker could use this vulnerability to run arbitrary code within the context of a different site. Alternatively, if chrome were to call, then attacker-defined functions could be run with chrome privileges.

Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail.