NVD

Id
12739  
Name
CVE-2010-1206  
Description
The startDocumentLoad function in browser/base/content/browser.js in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, does not properly implement the Same Origin Policy in certain circumstances related to the about:blank document and a document that is currently loading, which allows (1) remote web servers to conduct spoofing attacks via vectors involving a 204 (aka No Content) status code, and allows (2) remote attackers to conduct spoofing attacks via vectors involving a window.stop call.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-18  
Published
2010-06-25  
Modified Date
2010-08-21  
Seq
2010-1206  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
70238 12739 CVE-2010-1206 http://hg.mozilla.org/mozilla-central/rev/cadddabb1178  View
70239 12739 CVE-2010-1206 http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html  View
70240 12739 CVE-2010-1206 oval:org.mitre.oval:def:8248  View
70241 12739 CVE-2010-1206 http://www.mozilla.org/security/announce/2010/mfsa2010-45.html  View
70242 12739 CVE-2010-1206 https://bugzilla.mozilla.org/show_bug.cgi?id=556957  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36045 JVNDB-2010-001825 複数の Mozilla 製品の startDocumentLoad 関数における脆弱性 複数の Mozilla 製品の browser/base/content/browser.js 内にある startDocumentLoad 関数には、about:blank および読み込み中のドキュメントに関する同一生成元ポリシーを適切に実装しないため、なりすまし攻撃を受ける脆弱性が存在します。 CVE-2010-1206 43786 CVE-2010-1206 12739 4.3 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001825.html 2010-06-25 2011-01-06 View